tlp: testing migration blocked despite CVE-2025-67859 fixed
Hi,
According to [1], forky is vulnerable to CVE-2025-67859, but this is
wrong, since it was introduced in 1.9.0-1, whereas forky still has
1.8.0-1. Besides, trixie, which also has 1.8.0-1, is stated as not
vulnerable.
I tried to handle this before uploading 1.9.1-1 by creating a bug report
[2] to prevent 1.9.0-1 to enter testing, but maybe I messed up the
"found" and "notfound" tags (it's the first time I do this).
Also, according to [3], tlp won't migrate to testing because it would
introduce this security issue in testing, but this is wrong since
1.9.1-1 rightly fixes this issue.
Can you please fix the situation ? Or explain to me what I have to do to
fix this ?
Please CC me since I'm not subscribed to the mailing list.
[1] https://security-tracker.debian.org/tracker/CVE-2025-67859
[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1125019
[3] https://tracker.debian.org/pkg/tlp
Regards,
--
Raphaël Halimi
Reply to: