Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.java > #12352

Bug#700610: bsh (BeanShell) security vulnerability (CVE-2016-2510)

Cross-posted to 2 groups.

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

On Wed, 23 Feb 2022, Thorsten Glaser wrote:

> On Tue, 22 Feb 2022, Thomas Uhle wrote:
>
> > What do you think, wouldn't it be time for an update in Debian?
>
> The comment
> > at https://github.com/beanshell/beanshell/issues/603 .
> reads for me more like a “maybe remove it instead…”.
>
> Honestly though, if it’s not available in Central, upstreams will
> not use it and stick to old beta versions. If Debian has a newer
> one, which may be incompatible, we’re inviting problems.

That might be true although the BeanShell developers claim in their 
announcment of version 2.1.0 to be backward compatible with version 2.0b6, 
and only suitable backports from the upcoming version 3.0 of BeanShell 
have made it into version 2.1.0.  But even then Debian could move on to 
version 2.0b6 at least.  It is the latest version of BeanShell on Maven 
Central.

Perhaps we might have a better picture after a look at other Linux 
distributions.  Arch, Fedora and Mageia for instance already have version 
2.1.0 onboard whereas Gentoo, OpenMandriva, openSUSE and Red Hat stay with 
version 2.0b6 (... to name just a few).  So it is quite mixed.  But I 
haven't seen any Linux distribution so far (apart from those derived from 
Debian like Linux Mint, Ubuntu, etc.) that still have version 2.0b4.
It seems that both decisions (either to update to version 2.1.0 or to 
version 2.0b6) are reasonable.

Best regards,

Thomas Uhle

Back to linux.debian.maint.java | Previous | Next — Previous in thread | Next in thread | Find similar

Thread

bsh (BeanShell) security vulnerability (CVE-2016-2510) Stian Soiland-Reyes <stain@apache.org> - 2016-02-19 13:20 +0100
  Re: bsh (BeanShell) security vulnerability (CVE-2016-2510) Emmanuel Bourg <ebourg@apache.org> - 2016-02-19 14:40 +0100
    Bug#700610: bsh (BeanShell) security vulnerability (CVE-2016-2510) Stian Soiland-Reyes <stain@apache.org> - 2016-02-19 17:30 +0100
      Bug#700610: bsh (BeanShell) security vulnerability (CVE-2016-2510) Thomas Uhle <thomas.uhle@mailbox.tu-dresden.de> - 2022-02-23 00:00 +0100
        Bug#700610: bsh (BeanShell) security vulnerability (CVE-2016-2510) Thorsten Glaser <t.glaser@tarent.de> - 2022-02-23 00:40 +0100
          Bug#700610: bsh (BeanShell) security vulnerability (CVE-2016-2510) Thomas Uhle <thomas.uhle@mailbox.tu-dresden.de> - 2022-02-25 22:40 +0100
  Re: bsh (BeanShell) security vulnerability (CVE-2016-2510) Markus Koschany <apo@debian.org> - 2016-02-26 15:00 +0100
    Re: bsh (BeanShell) security vulnerability (CVE-2016-2510) Stian Soiland-Reyes <stain@apache.org> - 2016-02-29 13:10 +0100
    Re: bsh (BeanShell) security vulnerability (CVE-2016-2510) Sébastien Delafond <seb@debian.org> - 2016-03-01 14:20 +0100
      Re: bsh (BeanShell) security vulnerability (CVE-2016-2510) Markus Koschany <apo@debian.org> - 2016-03-01 16:10 +0100
        Re: bsh (BeanShell) security vulnerability (CVE-2016-2510) Sébastien Delafond <seb@debian.org> - 2016-03-01 17:10 +0100

csiph-web