Bug#962067: buster-pu: package dbus/1.12.20-0+deb10u1
On Sun, 2020-07-05 at 13:24 +0100, Simon McVittie wrote:
> Control: retitle -1 buster-pu: package dbus/1.12.20-0+deb10u1
>
> On Sat, 20 Jun 2020 at 20:26:24 +0100, Adam D. Barratt wrote:
> > On Tue, 2020-06-02 at 21:22 +0100, Simon McVittie wrote:
> > > dbus 1.12.18 fixes a local denial of service vulnerability for
> > > which the Security Team have indicated they do not intend to
> > > issue a DSA.
> > >
> > > If possible I would like to use upstream 1.12.x versions of dbus
> > > for buster (security and) stable updates, similar to the policy
> > > used in stretch and jessie. This branch includes security fixes
> > > and selected non-intrusive bug fixes (and unfortunately also the
> > > usual Autotools noise).
> > >
> >
> > That sounds OK to me, but will need the usual KiBi-ack due to the
> > udeb.
>
> I have now released 1.12.20 upstream. This fixes a long-standing
> use-after-free if two usernames have the same numeric uid (which is
> potentially a security fix if you have such usernames), and a
> regression on Solaris derivatives. Does this still look OK for
> buster-pu? (Diff since the version you already saw attached - I
> haven't bothered to filter out the Autotools noise this time, because
> there is much less of it.)
I'd be OK with that from the SRM side (with the remaining d-i caveat).
> I've asked the security team whether they will now want a DSA for the
> use-after-free, but I suspect the answer will be "no, talk to the
> stable release team" so I'm asking preemptively.
>
> For #962068, dbus 1.10.30 -> 1.10.32 has a remarkably similar diff
> (it's a cherry-pick of the same commits as in 1.12.20). I assume the
> judgement on that from both the security team and the stable release
> team will be the same as for buster, unless the stretch EOL has
> already happened by the time we get there.
My understanding is that security support for stretch ended yesterday.
(We've ended up with an extra week for fixes via opu due to
availability of people for the point release.)
Regards,
Adam
Reply to: