Path: csiph.com!fu-berlin.de!bofh.it!news.nic.it!robomod From: Sandro Tosi Newsgroups: linux.debian.maint.python Subject: Re: Please fix Debian bug 1032091 "py7zr: CVE-2022-44900" Date: Fri, 24 Mar 2023 02:10:01 +0100 Message-ID: References: X-Original-To: yokota X-Mailbox-Line: From debian-python-request@lists.debian.org Fri Mar 24 01:01:52 2023 Old-Return-Path: X-Amavis-Spam-Status: No, score=-6.48 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, FREEMAIL_FORGED_FROMDOMAIN=0.25, FREEMAIL_FROM=0.001, HEADER_FROM_DIFFERENT_DOMAINS=0.25, LDO_WHITELIST=-5, MURPHY_DRUGS_REL8=0.02, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-0.001] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate: -5.5 X-Gm-Message-State: AAQBX9ewF20lx8Zd3PrJYf/vRPmuuJbXgrL9HR+AGDHbNHMGztOW2IhS LRAK5/yY3987VnANCOEdBZzzJgfnVjYBI0gcxcNXUYaJ X-Google-SMTP-Source: AKy350YaYsCNfuW+n6QvTUx2JGrLHBVkD1lMQZILv89uhEAo3IrUYckX/ywsHNyrkUZV7dB2vqTwt7hmBtvWMdMcZTg= X-Received: by 2002:a67:d709:0:b0:422:194a:8566 with SMTP id p9-20020a67d709000000b00422194a8566mr470311vsj.5.1679619691864; Thu, 23 Mar 2023 18:01:31 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" X-Mailing-List: archive/latest/20894 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/CAB4XWXwX-0q=08cXVUEssajhY=9jweckpkT2Y-4FZU_5QtpEEA@mail.gmail.com Approved: robomod@news.nic.it Lines: 20 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: debian-python@lists.debian.org X-Original-Date: Thu, 23 Mar 2023 21:01:05 -0400 X-Original-Message-ID: X-Original-References: Xref: csiph.com linux.debian.maint.python:14986 > Debian "py7zr" package has security issue CVE-2022-44900, > and this issue affects Debian "calibre" package because "calibre" depends > this "py7zr" module. > https://tracker.debian.org/pkg/py7zr > > Please examine Debian bug report 1032091, and fix this issue. > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1032091 > > Debian release system will auto-remove these packages from testing distribution > on Wed 12 Apr 2023. feel free to provide a patch to fix it. upgrading to newer upstream releases is prohibitive given the increasing amount of additional/frivolous dependencies upstream decided to rely on. -- Sandro "morph" Tosi My website: http://sandrotosi.me/ Me at Debian: http://wiki.debian.org/SandroTosi Twitter: https://twitter.com/sandrotosi