Bug#1107568: bookworm-pu: package node-tar-fs/2.1.3-0+deb12u1
Control: tags -1 - moreinfo
Hi Adrian,
On Mon, Jun 09, 2025 at 11:27:12PM +0300, Adrian Bunk wrote:
> Package: release.debian.org
> Severity: normal
> Tags: bookworm moreinfo
> User: release.debian.org@packages.debian.org
> Usertags: pu
> X-Debbugs-Cc: security@debian.org, Debian Javascript Maintainers <pkg-javascript-devel@lists.alioth.debian.org>
>
> * New upstream release.
> - CVE-2024-12905: symlink path traversal (Closes: #1101501)
> - CVE-2025-48387: hardlink path traversal
>
> The two new upstream releases contain each just one CVE fix.
>
> Tagged moreinfo, as question to the security team whether they want
> this in pu or as DSA.
bookworm-pu is fine, thanks!
Regards,
Salvatore
Reply to: