Re: CVE-2021-31879 | CVE-2021-38371 | CVE-2016-2781| fixed packages

[Bjørn Mork <bjorn@mork.no>]

Sujeet Roy <sujeet.roy@optimalvirtualemployee.com> writes:

> Could you please provide us the deadline when we can can get the fixed
> packages for below packages :
>
> CVE-2021-31879
> CVE-2021-38371
>  CVE-2016-2781

I believe this is answered on https://www.debian.org/security/faq#cvedsa
which is pointed to from both https://www.debian.org/security/ and
https://www.debian.org/doc/manuals/securing-debian-manual/

Let me copy the answer here for your convenience:

 Q: Does Debian issue a DSA for every CVE id?

 A: The Debian security team keeps track of every issued CVE identifier,
    connect it to the relevant Debian package and assess its impact in a
    Debian context - the fact that something is assigned a CVE id does
    not necessarily imply that the issue is a serious threat to a Debian
    system. This information is tracked in the Debian Security Tracker
    and for the issues that are considered serious a Debian Security
    Advisory will be issued.

    Low-impact issues not qualifying for a DSA can be fixed in the next
    release of Debian, in a point release of the current stable or
    oldstable distributions, or are included in a DSA when that is being
    issued for a more serious vulnerability.


If you read the notes made by the security team at

 https://security-tracker.debian.org/tracker/CVE-2021-31879
 https://security-tracker.debian.org/tracker/CVE-2021-38371
 https://security-tracker.debian.org/tracker/CVE-2016-2781

then you'll see that all of these are identified as "Minor issue". And
there are even more hints on when you can expect a fix on two of them:

 wget <postponed> (Minor issue; can be fixed in next update)
 exim4 <postponed> (Minor issue, revisit when fixed upstream)

Given that those answers are already available to you, I don't think
it's appropriate to demand further details or timelines.

You are of course free to disagree with the security team on the
importance of these bugs.  But then you should rather discuss that in
the bug reports linked from the security-tracker, providing your
arguments.  And maybe even suggest a fix if you have one.

Repeated questions answered by the FAQ is just unnecessary noise.


Bjørn (not part of Debian or the security team)