Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.java > #12322

Re: libspring-java support

Show key headers only | View raw

[Multipart message — attachments visible in raw view] - view raw

Hi Sylvain,

Am Freitag, dem 03.12.2021 um 14:28 +0100 schrieb Sylvain Beucler:
> Hi,
> 
> This year I worked on libspring-java twice for LTS&ELTS. In both case 
> upstream provided limited information for the CVEs, and for 5 of them 
> we're unable to determine the fixes.
> https://deb.freexian.com/extended-lts/tracker/source-package/libspring-java
> 
> Upstream declined to provide information to identify the fixes (which in 
> turn would allow us to determine whether stretch and jessie are 
> affected, and backport the fixes if needed).
> https://github.com/spring-projects/spring-framework/issues/26821
> https://github.com/spring-projects/spring-framework/issues/27647
> 
> They made clear that they wouldn't provide this information even if 
> paid, confirming they apply a security-by-obscurity strategy similar to 
> Oracle's.
> 
> I exchanged with the Debian security team after they witnessed the last 
> exchanges above, and 2 weeks ago they concluded the latest CVE was minor 
> and no action was needed right now. I insisted about the other, prior 
> unfixable CVEs (1/4 impacting buster) but they haven't answered yet.
> 
> I think we're not in capacity to offer further security support for 
> libspring-java for LTS and ELTS, but I'd like to hear from other team 
> members, especially if they work in the Java team (Markus?) - what do 
> you think?
> 
> Cheers!
> Sylvain Beucler
> Debian LTS Team
> 

I have made similar experiences like you when I contacted upstream and asked
for more information about previous CVE. I agree with you that their policy
makes future security support for us nearly impossible. Currently the main
purpose of libspring-java is to build other software from source. We don't ship
any application or web project that depends on Spring and exposes users to the
currently unfixed CVE which means the current status of all CVE in
Stretch/Buster/Bullseye (no-dsa/minor) is correct. It is also very unlikely
that Java developers who use Spring/Spring Boot for their web applications
depend on one of our Debian packages. 

In my opinion it is OK to ignore the currently known CVE. I would support
adding libspring-java to the list of unsupported packages because of the lack
of upstream support. We, as the Java team, should make this clear by mentioning
libspring-java in the next release notes for Debian 12.

Regards,

Markus

Back to linux.debian.maint.java | Previous | Next — Next in thread | Find similar

Thread

Re: libspring-java support Markus Koschany <apo@debian.org> - 2021-12-04 00:00 +0100
  Re: libspring-java support Sylvain Beucler <beuc@beuc.net> - 2022-04-01 12:10 +0200
    Re: libspring-java support Holger Levsen <holger@layer-acht.org> - 2022-04-02 14:40 +0200
  Re: libspring-java support Emilio Pozuelo Monfort <pochu@debian.org> - 2022-04-01 12:10 +0200

csiph-web