Your message dated Sat, 16 Nov 2019 10:08:47 +0000 with message-id <83c9ffab6f08361485f70dda4733a7a24aeec09b.camel@adam-barratt.org.uk> and subject line Closing bugs for 10.2 point release fixes has caused the Debian Bug report #941227, regarding buster-pu: package node-set-value/0.4.0-1+deb10u1 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact owner@bugs.debian.org immediately.) -- 941227: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=941227 Debian Bug Tracking System Contact owner@bugs.debian.org with problems
--- Begin Message ---
- To: Debian Bug Tracking System <submit@bugs.debian.org>
- Subject: buster-pu: package node-set-value/0.4.0-1+deb10u1
- From: Xavier Guimard <yadd@debian.org>
- Date: Thu, 26 Sep 2019 20:11:41 +0200
- Message-id: <156952150103.4532.14535276348945603050.reportbug@deb007.xnr.fr>
Package: release.debian.org Severity: normal Tags: buster User: release.debian.org@packages.debian.org Usertags: pu Hi, node-set-value is vulnerable to prototype pollution (#941189, CVE-2019-10747). I imported and adapted upstream patch and added a test inspired from CVE report [1]. I think this could be safely added to next buster point release. Cheers, Xavier [1]: https://snyk.io/vuln/SNYK-JS-SETVALUE-450213
--- End Message ---
--- Begin Message ---
- To: 931766-done@bugs.debian.org, 932900-done@bugs.debian.org, 935250-done@bugs.debian.org, 935252-done@bugs.debian.org, 935392-done@bugs.debian.org, 939015-done@bugs.debian.org, 939166-done@bugs.debian.org, 939313-done@bugs.debian.org, 939354-done@bugs.debian.org, 939432-done@bugs.debian.org, 939446-done@bugs.debian.org, 939526-done@bugs.debian.org, 939738-done@bugs.debian.org, 939757-done@bugs.debian.org, 939831-done@bugs.debian.org, 939890-done@bugs.debian.org, 939965-done@bugs.debian.org, 940112-done@bugs.debian.org, 940170-done@bugs.debian.org, 940245-done@bugs.debian.org, 940476-done@bugs.debian.org, 940521-done@bugs.debian.org, 940548-done@bugs.debian.org, 940685-done@bugs.debian.org, 940686-done@bugs.debian.org, 940818-done@bugs.debian.org, 940943-done@bugs.debian.org, 941168-done@bugs.debian.org, 941227-done@bugs.debian.org, 941348-done@bugs.debian.org, 941451-done@bugs.debian.org, 941468-done@bugs.debian.org, 941683-done@bugs.debian.org, 941738-done@bugs.debian.org, 942044-done@bugs.debian.org, 942075-done@bugs.debian.org, 942177-done@bugs.debian.org, 942209-done@bugs.debian.org, 942253-done@bugs.debian.org, 942349-done@bugs.debian.org, 942356-done@bugs.debian.org, 942446-done@bugs.debian.org, 942486-done@bugs.debian.org, 942524-done@bugs.debian.org, 942827-done@bugs.debian.org, 943339-done@bugs.debian.org, 943364-done@bugs.debian.org, 943594-done@bugs.debian.org, 943605-done@bugs.debian.org, 943667-done@bugs.debian.org, 943766-done@bugs.debian.org, 943846-done@bugs.debian.org, 943882-done@bugs.debian.org, 944002-done@bugs.debian.org, 944009-done@bugs.debian.org, 944064-done@bugs.debian.org, 944119-done@bugs.debian.org, 944133-done@bugs.debian.org, 944238-done@bugs.debian.org, 944252-done@bugs.debian.org, 944374-done@bugs.debian.org, 944390-done@bugs.debian.org
- Subject: Closing bugs for 10.2 point release fixes
- From: "Adam D. Barratt" <adam@adam-barratt.org.uk>
- Date: Sat, 16 Nov 2019 10:08:47 +0000
- Message-id: <83c9ffab6f08361485f70dda4733a7a24aeec09b.camel@adam-barratt.org.uk>
Package: release.debian.org Version: 10.2 Hi, The fixes referenced by these bugs were included in today's 10.2 stable point release. Regards, Adam
--- End Message ---