Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.maint.python > #14985 > unrolled thread
| Started by | yokota <yokota.hgml@gmail.com> |
|---|---|
| First post | 2023-03-24 01:00 +0100 |
| Last post | 2023-03-25 05:00 +0100 |
| Articles | 3 — 2 participants |
Back to article view | Back to linux.debian.maint.python
Please fix Debian bug 1032091 "py7zr: CVE-2022-44900" yokota <yokota.hgml@gmail.com> - 2023-03-24 01:00 +0100
Re: Please fix Debian bug 1032091 "py7zr: CVE-2022-44900" Sandro Tosi <morph@debian.org> - 2023-03-24 02:10 +0100
Re: Please fix Debian bug 1032091 "py7zr: CVE-2022-44900" yokota <yokota.hgml@gmail.com> - 2023-03-25 05:00 +0100
| From | yokota <yokota.hgml@gmail.com> |
|---|---|
| Date | 2023-03-24 01:00 +0100 |
| Subject | Please fix Debian bug 1032091 "py7zr: CVE-2022-44900" |
| Message-ID | <GcD0B-eCT0-1@gated-at.bofh.it> |
Hello, Python maintainers. Debian "py7zr" package has security issue CVE-2022-44900, and this issue affects Debian "calibre" package because "calibre" depends this "py7zr" module. https://tracker.debian.org/pkg/py7zr Please examine Debian bug report 1032091, and fix this issue. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1032091 Debian release system will auto-remove these packages from testing distribution on Wed 12 Apr 2023. Thanks, -- YOKOTA Hiroshi
[toc] | [next] | [standalone]
| From | Sandro Tosi <morph@debian.org> |
|---|---|
| Date | 2023-03-24 02:10 +0100 |
| Message-ID | <GcE6l-eDP9-1@gated-at.bofh.it> |
| In reply to | #14985 |
> Debian "py7zr" package has security issue CVE-2022-44900, > and this issue affects Debian "calibre" package because "calibre" depends > this "py7zr" module. > https://tracker.debian.org/pkg/py7zr > > Please examine Debian bug report 1032091, and fix this issue. > https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1032091 > > Debian release system will auto-remove these packages from testing distribution > on Wed 12 Apr 2023. feel free to provide a patch to fix it. upgrading to newer upstream releases is prohibitive given the increasing amount of additional/frivolous dependencies upstream decided to rely on. -- Sandro "morph" Tosi My website: http://sandrotosi.me/ Me at Debian: http://wiki.debian.org/SandroTosi Twitter: https://twitter.com/sandrotosi
[toc] | [prev] | [next] | [standalone]
| From | yokota <yokota.hgml@gmail.com> |
|---|---|
| Date | 2023-03-25 05:00 +0100 |
| Message-ID | <Gd3ep-eU3r-1@gated-at.bofh.it> |
| In reply to | #14986 |
Hello, Sandro. > feel free to provide a patch to fix it. upgrading to newer upstream > releases is prohibitive given the increasing amount of > additional/frivolous dependencies upstream decided to rely on. Thanks for your quick response. I was pushed merge request to Debian salsa repository about this issue. https://salsa.debian.org/python-team/packages/py7zr/-/merge_requests/2 -- YOKOTA
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.maint.python
csiph-web