Bug#796114: Phasing out libnetty-java (was Re: Bug#796114: CVE-2015-2156)

From	Charles Plessy <plessy@debian.org>
Newsgroups	linux.debian.bugs.rc
Subject	Bug#796114: Phasing out libnetty-java (was Re: Bug#796114: CVE-2015-2156)
Date	2015-08-20 13:50 +0200
Message-ID	<pZww2-3MB-19@gated-at.bofh.it> (permalink)
References	<pZda2-150-7@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Le Wed, Aug 19, 2015 at 04:59:58PM +0200, Moritz Muehlenhoff a écrit :
> Source: netty
> Severity: grave
> Tags: security
> 
> This was assigned CVE-2015-2156:
> http://netty.io/news/2015/05/08/3-9-8-Final-and-3.html
> 
> Fix:
> https://github.com/slandelle/netty/commit/800555417e77029dcf8a31d7de44f27b5a8f79b8.patch
> 
> In addition to src:netty (3.2.6), there's also src:netty-3.9 (3.9.0)
> and there was also src:netty3.1 at some point (now removed).
> 
> Please phase out src:netty towards the updated src:netty-3.9 so that
> there's only one version around.

Hello everybody,

in my understanding, libnetty-java is a relic of when we attempted to package
Eucalyptus in Debian.  However, there are two new packages, zookeeper and
bookkeeper, created recently, that depend on libnetty-java instead of the more
recent libnetty-3.9-java.

Is that because of incompatibility ?  If libnetty-java is still needed, would
it be possible to transfer it under the umbrella of the Debian Java team ?

Have a nice day,

Charles

-- 
Charles Plessy
Debian Med packaging team,
http://www.debian.org/devel/debian-med
Tsurumi, Kanagawa, Japan

Back to linux.debian.bugs.rc | Previous | Next | Find similar

Thread

Bug#796114: Phasing out libnetty-java (was Re: Bug#796114: CVE-2015-2156) Charles Plessy <plessy@debian.org> - 2015-08-20 13:50 +0200

csiph-web