Groups > linux.debian.bugs.dist > #1222860

Bug#1089071: bookworm-pu: package python3.11/3.11.2-6+deb12u5

From	Salvatore Bonaccorso <carnil@debian.org>
Newsgroups	linux.debian.bugs.dist, linux.debian.devel.release
Subject	Bug#1089071: bookworm-pu: package python3.11/3.11.2-6+deb12u5
Date	2024-12-05 22:30 +0100
Message-ID	<JQrA5-e04Z-9@gated-at.bofh.it> (permalink)
References	<JQ5ge-dLIO-9@gated-at.bofh.it> <JQ5ge-dLIO-9@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

Control: tags -1 - moreinfo

Hi Adrian,

On Wed, Dec 04, 2024 at 11:29:46PM +0200, Adrian Bunk wrote:
> Package: release.debian.org
> Severity: normal
> Tags: bookworm moreinfo
> User: release.debian.org@packages.debian.org
> Usertags: pu
> X-Debbugs-Cc: security@debian.org, Matthias Klose <doko@debian.org>
> 
>   * CVE-2023-27043: Reject malformed addresses in email.parseaddr()
>     (Closes: #1059298)
>   * CVE-2024-6923: Encode newlines in headers in the email module
>   * CVE-2024-7592: Quadratic complexity parsing cookies with backslashes
>   * CVE-2024-9287: venv activation scripts did't quote paths
>   * CVE-2024-11168: urllib functions improperly validated bracketed hosts
> 
> Tagged moreinfo, as question to the security team whether they want
> this in -pu or as DSA.

yes the point release route and batching this update together with
oters seems fine, in particular given the next point release is
scheduled to be in ~1 month.

Regards,
Salvatore

Back to linux.debian.bugs.dist | Previous | Next | Find similar | Unroll thread

Thread

Bug#1089071: bookworm-pu: package python3.11/3.11.2-6+deb12u5 Salvatore Bonaccorso <carnil@debian.org> - 2024-12-05 22:30 +0100

csiph-web