Bug#987038: buster-pu: package clamav/0.103.2+dfsg-0+deb10u1
On 2021-04-22 16:58:46 [+0100], Adam D. Barratt wrote:
> On Wed, 2021-04-21 at 21:35 +0200, Sebastian Andrzej Siewior wrote:
> > On 2021-04-20 20:52:09 [+0100], Adam D. Barratt wrote:
> > > Please feel free to upload. I assume that, given there are security
> > > fixes involved, you'd prefer an early release via stable-updates as
> > > we've done with a number of updates in the past?
> >
> > Thank you, uploaded. Yes, please. In the past we had it stable-pu for
> > a day or two and then enabled it via stable/updates if I remember
> > correctly.
>
> I think that's more a function of the time it takes to notice that
> everything built, prepare the SUA text and then have an SRM be
> available near enough to a dinstall to release the announcement mail,
> rather than a deliberate choice.
I see.
> I drafted some text for an SUA; comments / complete rewriting welcome:
>
> =========================================================
> ClamAV is an AntiVirus toolkit for Unix.
>
> Upstream published version 0.103.2.
>
> This is a bug-fix release.
>
> Changes since 0.102.3 currently in buster include the removal of the
> "safe browsing" signature database, and fixes for security issues.
This version also introduced non-blocking database reloads in which
clamd temporary requires twice as much memory. The behaviour is
controlled by the ConcurrentDatabaseReload option.
> CVE-2021-1405
>
> A vulnerability in the email parsing module could allow an
> unauthenticated, remote attacker to cause a denial of service
> condition on an affected device
>
> If you use clamav, we recommend that you install this update.
> =========================================================
>
> I realise that there are fixes for more CVEs in 0.103.2, but did not
> mention them as they're not changes relative to the current buster
> package AIUI.
This is correct.
> I also removed our usual "[t]he changes are not strictly
> required for operation" text, as I wasn't sure if that's actually
> accurate in this case.
Yes, at least due to the CVEs in here I would consider that this is
required for operation due to security aspect.
Thank you.
> Regards,
>
> Adam
Sebastian
Reply to: