Re: CAN to CVE: changing changelogs?
Joey Hess <joeyh@debian.org> writes:
> One thing that this bug illustrates pretty well that is quite annoying
> when trying to determine what version of a package actually fixed a
> security hole, is new upstream releases that are listed in the changelog
> as fixing a particular CVE, when the hole was actually fixed in a
> previous debian revision of the old upstream version. That's a case
> where clarity is very useful in the changelog. (So is proper use of the
> new version tracking features of the BTS.)
Seems to me that the right thing to do is:
close the bug with the right version using -done;
add a *new* changelog entry (not altering the old one), saying "bug
such-and-such was fixed in such-and-such old version."
Reply to: