Bug#928291: unblock: signing-party/2.10-1

[Ivo De Decker <ivodd@debian.org>]

Control: tags -1 moreinfo confirmed

Hi,

On Wed, May 01, 2019 at 01:44:08PM +0200, Guilhem Moulin wrote:
> On Wed, 01 May 2019 at 12:46:12 +0200, Guilhem Moulin wrote:
> > gpg-key2ps(1) from signing-party 2.9-1 is vulnerable to CVE-2018-15599:
> > unsafe shell call enabling shell injection via a User ID.
> 
> Erm that should be CVE-2019-11627, and the changelog is wrong as well.
> Would you like me to upload a 2.10-1 with a fixed debian/changelog?

You can't upload 2.10-1 again, so that would need to be 2.10-2. In that case,
please don't include the 2.10-1 entry in the changelog, to make sure the wrong
CVE number isn't in there.

If you do so, please remove the moreinfo tag from this bug once the new
package is in unstable. Otherwise, you can remove the moreinfo tag and ask for
this version to be unblocked as well.

Thanks,

Ivo