Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4562 > unrolled thread

working for wheezy-security until wheezy-lts starts

Started byMike Gabriel <sunweaver@debian.org>
First post2016-02-29 16:30 +0100
Last post2016-03-27 16:30 +0200
Articles 8 — 4 participants

Back to article view | Back to linux.debian.security

Contents

  working for wheezy-security until wheezy-lts starts Mike Gabriel <sunweaver@debian.org> - 2016-02-29 16:30 +0100
    Re: working for wheezy-security until wheezy-lts starts Guido Günther <agx@sigxcpu.org> - 2016-02-29 22:00 +0100
      Re: working for wheezy-security until wheezy-lts starts Mike Gabriel <sunweaver@debian.org> - 2016-03-01 08:20 +0100
        Re: working for wheezy-security until wheezy-lts starts Guido Günther <agx@sigxcpu.org> - 2016-03-01 08:50 +0100
          Re: working for wheezy-security until wheezy-lts starts Mike Gabriel <sunweaver@debian.org> - 2016-03-01 09:10 +0100
            Re: working for wheezy-security until wheezy-lts starts Sébastien Delafond <seb@debian.org> - 2016-03-01 15:10 +0100
              Re: working for wheezy-security until wheezy-lts starts Moritz Muehlenhoff <jmm@inutil.org> - 2016-03-01 20:10 +0100
                DSA for lxc CVE-2015-1335 [was Re: working for wheezy-security until  wheezy-lts starts] Guido Günther <agx@sigxcpu.org> - 2016-03-27 16:30 +0200

#4562 — working for wheezy-security until wheezy-lts starts

FromMike Gabriel <sunweaver@debian.org>
Date2016-02-29 16:30 +0100
Subjectworking for wheezy-security until wheezy-lts starts
Message-ID<r7xVM-4Nd-13@gated-at.bofh.it>

[Multipart message — attachments visible in raw view] — view raw

Hi all,

as of today, the Debian squeeze LTS support will cease and squeeze  
will finally enter the archived archives of Debian.

.oO( /me gets out his handkerchief ...)

As (paid) LTS contributor you may wonder what to do next, esp. until  
the official Debian wheezy LTS support period starts on 26th April  
2016. At least I did wonder about that, today...

One thing, we can do, I guess, is helping out with the Debian Security  
Team regarding package updates in Debian wheezy.

For this, we can run bin/lts-needs-forward-port.py from the  
secure-testing repo and see what issues we fixed in squeeze and port  
those fixes to the package version in wheezy-security. Package updates  
must be coordinated with the Debian Security Team, not within the LTS  
team, though:

   * prepare a fixed package
   * test the package
   * send a .debdiff to team@security.debian.org
   * wait for feedback and ideally permission to upload to wheezy-security

(Is the above said correct? Please elaborate, if not).

Currently, we have these candidates of potentially  
easy-to-fix-in-wheezy packages:

"""
Issues that are unfixed in wheezy but fixed in squeeze:
* aptdaemon            -> CVE-2015-1323
* cakephp              -> TEMP-0000000-698CF7
* dhcpcd               -> CVE-2012-6698 CVE-2012-6699 CVE-2012-6700
* eglibc               -> CVE-2014-9761
* extplorer            -> CVE-2015-0896
* fuseiso              -> TEMP-0779047-8CABD5 TEMP-0779047-E29D8E
* gosa                 -> CVE-2014-9760 CVE-2015-8771
* gtk+2.0              -> CVE-2013-7447
* icu                  -> CVE-2015-2632
* imagemagick          -> TEMP-0773834-5EB6CF
* imlib2               -> CVE-2014-9762 CVE-2014-9763 CVE-2014-9764
* inspircd             -> CVE-2015-8702
* libebml              -> CVE-2015-8790 CVE-2015-8791
* libidn               -> CVE-2015-2059 TEMP-0000000-54045E
* libmatroska          -> CVE-2015-8792
* libsndfile           -> CVE-2014-9756 CVE-2015-7805
* libstruts1.2-java    -> CVE-2015-0899
* libtorrent-rasterbar -> CVE-2015-5685
* mono                 -> CVE-2009-0689
* nss                  -> CVE-2015-7181 CVE-2015-7182 CVE-2016-1938
* optipng              -> CVE-2015-7801
* phpmyadmin           -> CVE-2016-2039 CVE-2016-2041
* pixman               -> CVE-2014-9766
* python-tornado       -> CVE-2014-9720
* roundcube            -> CVE-2015-8770
* srtp                 -> CVE-2015-6360
* tomcat6              -> CVE-2013-4286 CVE-2013-4322 CVE-2014-0033  
CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 CVE-2014-0119 CVE-2014-0227  
CVE-2014-0230 CVE-2014-7810 CVE-2015-5174 CVE-2015-5345 CVE-2015-5351  
CVE-2016-0706 CVE-2016-0714 CVE-2016-0763

Issues that are no-dsa in wheezy but fixed in squeeze:
* augeas               -> CVE-2012-0786 CVE-2012-0787
* binutils             -> TEMP-0000000-A2945B
* busybox              -> TEMP-0803097-A74121
* chrony               -> CVE-2016-1567
* dbconfig-common      -> TEMP-0805638-5AC56F
* dwarfutils           -> CVE-2015-8750
* foomatic-filters     -> TEMP-0000000-ACBC4C
* imagemagick          -> CVE-2014-8354 CVE-2014-8355 CVE-2014-8562  
CVE-2014-8716 TEMP-0806441-76CD60 TEMP-0806441-CB092C
* libemail-address-perl -> TEMP-0000000-F41FA7
* libfcgi-perl         -> CVE-2012-6687
* librsvg              -> CVE-2015-7557
* libsndfile           -> CVE-2014-9496
* libunwind            -> CVE-2015-3239
* openslp-dfsg         -> CVE-2012-4428
* openssh              -> CVE-2015-5352 CVE-2015-5600
* php5                 -> CVE-2011-0420 CVE-2011-1657
* postgresql-8.4       -> CVE-2015-3165 CVE-2015-3166 CVE-2015-3167  
CVE-2015-5288
* python-scipy         -> CVE-2013-4251
* python2.6            -> CVE-2011-4940 CVE-2013-4238 CVE-2014-1912
* qt4-x11              -> CVE-2015-0295 CVE-2015-1858 CVE-2015-1859  
CVE-2015-1860
* remind               -> CVE-2015-5957
* ruby1.8              -> CVE-2009-5147
* ruby1.9.1            -> CVE-2009-5147
* t1utils              -> CVE-2015-3905
* texlive-extra        -> CVE-2012-2120
* tomcat6              -> CVE-2013-4590
* vorbis-tools         -> CVE-2014-9638 CVE-2014-9639 CVE-2014-9640  
CVE-2015-6749
"""

I am posting this CVE/package list here on purpose, because the said  
script may not be working anymore, once the squeeze Debian package  
repo section has been moved to archive.debian.org.

Furthermore, as it seems, we need to modify some bits and pieces in  
the secure-testing repo to get our workflow up-and-running for Debian  
wheezy LTS. Is anyone already working on that? What is the current  
status?

Has there already been a discussion that I am not aware of about how  
the LTS team can work on wheezy-security updates in a coordinated  
fashion until the 26th of April? If there has not been a discussion,  
yet, we should sort this out during this week. My proposal would be to  
prepare the Debian wheezy LTS workflow in the secure-testing SVN repo,  
so that our upcoming workflow can be very similar to what we are used  
to. For the interim phase until the 26th of April 2016, however, we  
need to run a modified approach.


Request for feedback and comments... (I have some concrete proposals  
in mind, but I want to check, if these issues have already been  
solved, first).

light+love
Mike




-- 

mike gabriel aka sunweaver (Debian Developer)
fon: +49 (1520) 1976 148

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: sunweaver@debian.org, http://sunweavers.net

[toc] | [next] | [standalone]

#4563

FromGuido Günther <agx@sigxcpu.org>
Date2016-02-29 22:00 +0100
Message-ID<r7D58-7Z4-11@gated-at.bofh.it>
In reply to#4562
Hi,
On Mon, Feb 29, 2016 at 03:25:46PM +0000, Mike Gabriel wrote:
> For this, we can run bin/lts-needs-forward-port.py from the secure-testing
> repo and see what issues we fixed in squeeze and port those fixes to the
> package version in wheezy-security. Package updates must be coordinated with
> the Debian Security Team, not within the LTS team, though:
> 
>   * prepare a fixed package
>   * test the package
>   * send a .debdiff to team@security.debian.org
>   * wait for feedback and ideally permission to upload to wheezy-security

That's what I'm doing at the moment (sending the debdiff to the bug
report in case there is one as well) for issues that are unfixed (not
no-dsa, see below).

[..snip..]

> Issues that are unfixed in wheezy but fixed in squeeze:
> * aptdaemon            -> CVE-2015-1323
> * cakephp              -> TEMP-0000000-698CF7
> * dhcpcd               -> CVE-2012-6698 CVE-2012-6699 CVE-2012-6700
> * eglibc               -> CVE-2014-9761
> * extplorer            -> CVE-2015-0896
> * fuseiso              -> TEMP-0779047-8CABD5 TEMP-0779047-E29D8E
> * gosa                 -> CVE-2014-9760 CVE-2015-8771
> * gtk+2.0              -> CVE-2013-7447
> * icu                  -> CVE-2015-2632
> * imagemagick          -> TEMP-0773834-5EB6CF
> * imlib2               -> CVE-2014-9762 CVE-2014-9763 CVE-2014-9764
> * inspircd             -> CVE-2015-8702
> * libebml              -> CVE-2015-8790 CVE-2015-8791
> * libidn               -> CVE-2015-2059 TEMP-0000000-54045E
> * libmatroska          -> CVE-2015-8792
> * libsndfile           -> CVE-2014-9756 CVE-2015-7805
> * libstruts1.2-java    -> CVE-2015-0899
> * libtorrent-rasterbar -> CVE-2015-5685
> * mono                 -> CVE-2009-0689
> * nss                  -> CVE-2015-7181 CVE-2015-7182 CVE-2016-1938
> * optipng              -> CVE-2015-7801
> * phpmyadmin           -> CVE-2016-2039 CVE-2016-2041
> * pixman               -> CVE-2014-9766
> * python-tornado       -> CVE-2014-9720
> * roundcube            -> CVE-2015-8770
> * srtp                 -> CVE-2015-6360
> * tomcat6              -> CVE-2013-4286 CVE-2013-4322 CVE-2014-0033
> CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 CVE-2014-0119 CVE-2014-0227
> CVE-2014-0230 CVE-2014-7810 CVE-2015-5174 CVE-2015-5345 CVE-2015-5351
> CVE-2016-0706 CVE-2016-0714 CVE-2016-0763

I'm focusing on these picking older ones over newer ones to not stomp
onto the security teams toes.

> 
> Issues that are no-dsa in wheezy but fixed in squeeze:
> * augeas               -> CVE-2012-0786 CVE-2012-0787
> * binutils             -> TEMP-0000000-A2945B
> * busybox              -> TEMP-0803097-A74121
> * chrony               -> CVE-2016-1567
> * dbconfig-common      -> TEMP-0805638-5AC56F
> * dwarfutils           -> CVE-2015-8750
> * foomatic-filters     -> TEMP-0000000-ACBC4C
> * imagemagick          -> CVE-2014-8354 CVE-2014-8355 CVE-2014-8562
> CVE-2014-8716 TEMP-0806441-76CD60 TEMP-0806441-CB092C
> * libemail-address-perl -> TEMP-0000000-F41FA7
> * libfcgi-perl         -> CVE-2012-6687
> * librsvg              -> CVE-2015-7557
> * libsndfile           -> CVE-2014-9496
> * libunwind            -> CVE-2015-3239
> * openslp-dfsg         -> CVE-2012-4428
> * openssh              -> CVE-2015-5352 CVE-2015-5600
> * php5                 -> CVE-2011-0420 CVE-2011-1657
> * postgresql-8.4       -> CVE-2015-3165 CVE-2015-3166 CVE-2015-3167
> CVE-2015-5288
> * python-scipy         -> CVE-2013-4251
> * python2.6            -> CVE-2011-4940 CVE-2013-4238 CVE-2014-1912
> * qt4-x11              -> CVE-2015-0295 CVE-2015-1858 CVE-2015-1859
> CVE-2015-1860
> * remind               -> CVE-2015-5957
> * ruby1.8              -> CVE-2009-5147
> * ruby1.9.1            -> CVE-2009-5147
> * t1utils              -> CVE-2015-3905
> * texlive-extra        -> CVE-2012-2120
> * tomcat6              -> CVE-2013-4590
> * vorbis-tools         -> CVE-2014-9638 CVE-2014-9639 CVE-2014-9640
> CVE-2015-6749
> """

I think these would be adressed via stable point release updates in
wheezy/jessie rather than going via the security team.

Cheers,
 -- Guido

[toc] | [prev] | [next] | [standalone]

#4564

FromMike Gabriel <sunweaver@debian.org>
Date2016-03-01 08:20 +0100
Message-ID<r7ML8-5Vt-7@gated-at.bofh.it>
In reply to#4563

[Multipart message — attachments visible in raw view] — view raw

Hi Guido,

On  Mo 29 Feb 2016 21:54:11 CET, Guido Günther wrote:

>>   * prepare a fixed package
>>   * test the package
>>   * send a .debdiff to team@security.debian.org
>>   * wait for feedback and ideally permission to upload to wheezy-security
>
> That's what I'm doing at the moment (sending the debdiff to the bug
> report in case there is one as well) for issues that are unfixed (not
> no-dsa, see below).

Ok.

>
> [..snip..]
>
>> Issues that are unfixed in wheezy but fixed in squeeze:
>> * aptdaemon            -> CVE-2015-1323
>> * cakephp              -> TEMP-0000000-698CF7
>> * dhcpcd               -> CVE-2012-6698 CVE-2012-6699 CVE-2012-6700
>> * eglibc               -> CVE-2014-9761
>> * extplorer            -> CVE-2015-0896
>> * fuseiso              -> TEMP-0779047-8CABD5 TEMP-0779047-E29D8E
>> * gosa                 -> CVE-2014-9760 CVE-2015-8771
>> * gtk+2.0              -> CVE-2013-7447
>> * icu                  -> CVE-2015-2632
>> * imagemagick          -> TEMP-0773834-5EB6CF
>> * imlib2               -> CVE-2014-9762 CVE-2014-9763 CVE-2014-9764
>> * inspircd             -> CVE-2015-8702
>> * libebml              -> CVE-2015-8790 CVE-2015-8791
>> * libidn               -> CVE-2015-2059 TEMP-0000000-54045E
>> * libmatroska          -> CVE-2015-8792
>> * libsndfile           -> CVE-2014-9756 CVE-2015-7805
>> * libstruts1.2-java    -> CVE-2015-0899
>> * libtorrent-rasterbar -> CVE-2015-5685
>> * mono                 -> CVE-2009-0689
>> * nss                  -> CVE-2015-7181 CVE-2015-7182 CVE-2016-1938
>> * optipng              -> CVE-2015-7801
>> * phpmyadmin           -> CVE-2016-2039 CVE-2016-2041
>> * pixman               -> CVE-2014-9766
>> * python-tornado       -> CVE-2014-9720
>> * roundcube            -> CVE-2015-8770
>> * srtp                 -> CVE-2015-6360
>> * tomcat6              -> CVE-2013-4286 CVE-2013-4322 CVE-2014-0033
>> CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 CVE-2014-0119 CVE-2014-0227
>> CVE-2014-0230 CVE-2014-7810 CVE-2015-5174 CVE-2015-5345 CVE-2015-5351
>> CVE-2016-0706 CVE-2016-0714 CVE-2016-0763
>
> I'm focusing on these picking older ones over newer ones to not stomp
> onto the security teams toes.

Do you announce anywhere, that you will start working on a specific  
package? Wouldn't it make sense to put all the packages listed below  
into data/dsa-needed.txt (with approval from the Security Team) and  
then put our names behind those package names?

@Security Team: Please guide the LTS contributors to a good way of  
supporting you. Would it make sense to add above packages to  
data/dsa-needed.txt so that then LTS contributors can grab packages  
from the dsa-needed.txt file and work on fixing the listed issues?

>>
>> Issues that are no-dsa in wheezy but fixed in squeeze:
>> * augeas               -> CVE-2012-0786 CVE-2012-0787
>> * binutils             -> TEMP-0000000-A2945B
>> * busybox              -> TEMP-0803097-A74121
>> * chrony               -> CVE-2016-1567
>> * dbconfig-common      -> TEMP-0805638-5AC56F
>> * dwarfutils           -> CVE-2015-8750
>> * foomatic-filters     -> TEMP-0000000-ACBC4C
>> * imagemagick          -> CVE-2014-8354 CVE-2014-8355 CVE-2014-8562
>> CVE-2014-8716 TEMP-0806441-76CD60 TEMP-0806441-CB092C
>> * libemail-address-perl -> TEMP-0000000-F41FA7
>> * libfcgi-perl         -> CVE-2012-6687
>> * librsvg              -> CVE-2015-7557
>> * libsndfile           -> CVE-2014-9496
>> * libunwind            -> CVE-2015-3239
>> * openslp-dfsg         -> CVE-2012-4428
>> * openssh              -> CVE-2015-5352 CVE-2015-5600
>> * php5                 -> CVE-2011-0420 CVE-2011-1657
>> * postgresql-8.4       -> CVE-2015-3165 CVE-2015-3166 CVE-2015-3167
>> CVE-2015-5288
>> * python-scipy         -> CVE-2013-4251
>> * python2.6            -> CVE-2011-4940 CVE-2013-4238 CVE-2014-1912
>> * qt4-x11              -> CVE-2015-0295 CVE-2015-1858 CVE-2015-1859
>> CVE-2015-1860
>> * remind               -> CVE-2015-5957
>> * ruby1.8              -> CVE-2009-5147
>> * ruby1.9.1            -> CVE-2009-5147
>> * t1utils              -> CVE-2015-3905
>> * texlive-extra        -> CVE-2012-2120
>> * tomcat6              -> CVE-2013-4590
>> * vorbis-tools         -> CVE-2014-9638 CVE-2014-9639 CVE-2014-9640
>> CVE-2015-6749
>> """
>
> I think these would be adressed via stable point release updates in
> wheezy/jessie rather than going via the security team.

Yeah, if at all. I just listed them for completeness sake.

Mike

-- 

mike gabriel aka sunweaver (Debian Developer)
fon: +49 (1520) 1976 148

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: sunweaver@debian.org, http://sunweavers.net

[toc] | [prev] | [next] | [standalone]

#4565

FromGuido Günther <agx@sigxcpu.org>
Date2016-03-01 08:50 +0100
Message-ID<r7Ne9-69t-1@gated-at.bofh.it>
In reply to#4564
On Tue, Mar 01, 2016 at 07:15:28AM +0000, Mike Gabriel wrote:
[..snip..]
> >>Issues that are unfixed in wheezy but fixed in squeeze:
> >>* aptdaemon            -> CVE-2015-1323
> >>* cakephp              -> TEMP-0000000-698CF7
> >>* dhcpcd               -> CVE-2012-6698 CVE-2012-6699 CVE-2012-6700
> >>* eglibc               -> CVE-2014-9761
> >>* extplorer            -> CVE-2015-0896
> >>* fuseiso              -> TEMP-0779047-8CABD5 TEMP-0779047-E29D8E
> >>* gosa                 -> CVE-2014-9760 CVE-2015-8771
> >>* gtk+2.0              -> CVE-2013-7447
> >>* icu                  -> CVE-2015-2632
> >>* imagemagick          -> TEMP-0773834-5EB6CF
> >>* imlib2               -> CVE-2014-9762 CVE-2014-9763 CVE-2014-9764
> >>* inspircd             -> CVE-2015-8702
> >>* libebml              -> CVE-2015-8790 CVE-2015-8791
> >>* libidn               -> CVE-2015-2059 TEMP-0000000-54045E
> >>* libmatroska          -> CVE-2015-8792
> >>* libsndfile           -> CVE-2014-9756 CVE-2015-7805
> >>* libstruts1.2-java    -> CVE-2015-0899
> >>* libtorrent-rasterbar -> CVE-2015-5685
> >>* mono                 -> CVE-2009-0689
> >>* nss                  -> CVE-2015-7181 CVE-2015-7182 CVE-2016-1938
> >>* optipng              -> CVE-2015-7801
> >>* phpmyadmin           -> CVE-2016-2039 CVE-2016-2041
> >>* pixman               -> CVE-2014-9766
> >>* python-tornado       -> CVE-2014-9720
> >>* roundcube            -> CVE-2015-8770
> >>* srtp                 -> CVE-2015-6360
> >>* tomcat6              -> CVE-2013-4286 CVE-2013-4322 CVE-2014-0033
> >>CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 CVE-2014-0119 CVE-2014-0227
> >>CVE-2014-0230 CVE-2014-7810 CVE-2015-5174 CVE-2015-5345 CVE-2015-5351
> >>CVE-2016-0706 CVE-2016-0714 CVE-2016-0763
> >
> >I'm focusing on these picking older ones over newer ones to not stomp
> >onto the security teams toes.
> 
> Do you announce anywhere, that you will start working on a specific package?
> Wouldn't it make sense to put all the packages listed below into
> data/dsa-needed.txt (with approval from the Security Team) and then put our
> names behind those package names?

In order to avoid double work I added these to dsa-needed.txt and put my
name on the line.

Cheers,
 -- Guido

[toc] | [prev] | [next] | [standalone]

#4566

FromMike Gabriel <sunweaver@debian.org>
Date2016-03-01 09:10 +0100
Message-ID<r7Nxx-6uW-19@gated-at.bofh.it>
In reply to#4565

[Multipart message — attachments visible in raw view] — view raw

On  Di 01 Mär 2016 08:44:08 CET, Guido Günther wrote:

> On Tue, Mar 01, 2016 at 07:15:28AM +0000, Mike Gabriel wrote:
> [..snip..]
>> >>Issues that are unfixed in wheezy but fixed in squeeze:
>> >>* aptdaemon            -> CVE-2015-1323
>> >>* cakephp              -> TEMP-0000000-698CF7
>> >>* dhcpcd               -> CVE-2012-6698 CVE-2012-6699 CVE-2012-6700
>> >>* eglibc               -> CVE-2014-9761
>> >>* extplorer            -> CVE-2015-0896
>> >>* fuseiso              -> TEMP-0779047-8CABD5 TEMP-0779047-E29D8E
>> >>* gosa                 -> CVE-2014-9760 CVE-2015-8771
>> >>* gtk+2.0              -> CVE-2013-7447
>> >>* icu                  -> CVE-2015-2632
>> >>* imagemagick          -> TEMP-0773834-5EB6CF
>> >>* imlib2               -> CVE-2014-9762 CVE-2014-9763 CVE-2014-9764
>> >>* inspircd             -> CVE-2015-8702
>> >>* libebml              -> CVE-2015-8790 CVE-2015-8791
>> >>* libidn               -> CVE-2015-2059 TEMP-0000000-54045E
>> >>* libmatroska          -> CVE-2015-8792
>> >>* libsndfile           -> CVE-2014-9756 CVE-2015-7805
>> >>* libstruts1.2-java    -> CVE-2015-0899
>> >>* libtorrent-rasterbar -> CVE-2015-5685
>> >>* mono                 -> CVE-2009-0689
>> >>* nss                  -> CVE-2015-7181 CVE-2015-7182 CVE-2016-1938
>> >>* optipng              -> CVE-2015-7801
>> >>* phpmyadmin           -> CVE-2016-2039 CVE-2016-2041
>> >>* pixman               -> CVE-2014-9766
>> >>* python-tornado       -> CVE-2014-9720
>> >>* roundcube            -> CVE-2015-8770
>> >>* srtp                 -> CVE-2015-6360
>> >>* tomcat6              -> CVE-2013-4286 CVE-2013-4322 CVE-2014-0033
>> >>CVE-2014-0075 CVE-2014-0096 CVE-2014-0099 CVE-2014-0119 CVE-2014-0227
>> >>CVE-2014-0230 CVE-2014-7810 CVE-2015-5174 CVE-2015-5345 CVE-2015-5351
>> >>CVE-2016-0706 CVE-2016-0714 CVE-2016-0763
>> >
>> >I'm focusing on these picking older ones over newer ones to not stomp
>> >onto the security teams toes.
>>
>> Do you announce anywhere, that you will start working on a specific package?
>> Wouldn't it make sense to put all the packages listed below into
>> data/dsa-needed.txt (with approval from the Security Team) and then put our
>> names behind those package names?
>
> In order to avoid double work I added these to dsa-needed.txt and put my
> name on the line.
>
> Cheers,
>  -- Guido

Ack.

@Security Team: Shall we (LTS contributors) handle wheezy-security  
updates like described below until Debian wheezy LTS comes into play?

   o Pick a package that has open CVE issues in wheezy, e.g. from above list
   o Add the package to data/dsa-needed.txt, if not already there:
     - packages with issues to be solved in wheezy only, should be suffixed
       with "/oldstable" (i.e., gosa/oldstable)
     - packages with issues in jessie and wheezy, should probably just be added
       by the package name (without suffix), right?

 From then on, the workflow can be the same workflow as used for  
normal security updates (as already described earlier in this thread):

   o Fix the issue in the package (grab the current package from  
oldstable's archive).
   o Test your fixes.
   o Provide a .debdiff to team@security.debian.org and to the Debian bug,
     if any related bug exists.
   o Wait for feedback from the release team on how to proceed.
   o As a courtesy, you could check the same package in jessie and see if
     the fix for oldstable is easily forward-portable. Thus, maybe providing a
     jessie-security .debdiff for the package can be an option.

The removal of the entry placed into data/dsa-needed.txt should then  
be handled by the Security Team, once the fixed package version has  
been uploaded.

More Feedback?
Mike
-- 

mike gabriel aka sunweaver (Debian Developer)
fon: +49 (1520) 1976 148

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: sunweaver@debian.org, http://sunweavers.net

[toc] | [prev] | [next] | [standalone]

#4576

FromSébastien Delafond <seb@debian.org>
Date2016-03-01 15:10 +0100
Message-ID<r7T9U-1Kv-21@gated-at.bofh.it>
In reply to#4566
On 2016-03-01, Mike Gabriel <sunweaver@debian.org> wrote:
> @Security Team: Shall we (LTS contributors) handle wheezy-security  
> updates like described below until Debian wheezy LTS comes into play?
>
>    o Pick a package that has open CVE issues in wheezy, e.g. from 
>      above list
>    o Add the package to data/dsa-needed.txt, if not already there:
>      - packages with issues to be solved in wheezy only, should be
>        suffixed with "/oldstable" (i.e., gosa/oldstable)
>      - packages with issues in jessie and wheezy, should probably
>        just be added by the package name (without suffix), right?
>
> From then on, the workflow can be the same workflow as used for
> normal security updates (as already described earlier in this
> thread):
>
>    o Fix the issue in the package (grab the current package from  
>       oldstable's archive).
>    o Test your fixes.
>    o Provide a .debdiff to
>      team@security.debian.org and to the
>      Debian bug, if any related bug exists.
>
>    o Wait for feedback from the release team on how to proceed.
>
>    o As a courtesy, you could check the same package in jessie and
>      see if the fix for oldstable is easily forward-portable. Thus,
>      maybe providing a jessie-security .debdiff for the package can
>      be an option.
>
> The removal of the entry placed into data/dsa-needed.txt should then
> be handled by the Security Team, once the fixed package version has
> been uploaded.  More Feedback?  Mike

Looking good to me; we can refine the process incrementally, if need
be.

Thanks a lot for the help,

--Seb

[toc] | [prev] | [next] | [standalone]

#4580

FromMoritz Muehlenhoff <jmm@inutil.org>
Date2016-03-01 20:10 +0100
Message-ID<r7XQg-4Tj-67@gated-at.bofh.it>
In reply to#4576
On Tue, Mar 01, 2016 at 02:08:56PM +0000, Sébastien Delafond wrote:
> On 2016-03-01, Mike Gabriel <sunweaver@debian.org> wrote:
> > @Security Team: Shall we (LTS contributors) handle wheezy-security  
> > updates like described below until Debian wheezy LTS comes into play?
> >
> >    o Pick a package that has open CVE issues in wheezy, e.g. from 
> >      above list
> >    o Add the package to data/dsa-needed.txt, if not already there:

Don't add anything to dsa-needed.txt directly, but rather ask team@ first 
whether this actually qualifies for a DSA. Packages get only added there
after individual assessment.

Cheers,
        Moritz

[toc] | [prev] | [next] | [standalone]

#4655 — DSA for lxc CVE-2015-1335 [was Re: working for wheezy-security until wheezy-lts starts]

FromGuido Günther <agx@sigxcpu.org>
Date2016-03-27 16:30 +0200
SubjectDSA for lxc CVE-2015-1335 [was Re: working for wheezy-security until wheezy-lts starts]
Message-ID<rhjRw-1bs-5@gated-at.bofh.it>
In reply to#4580
Hi,
On Tue, Mar 01, 2016 at 08:01:20PM +0100, Moritz Muehlenhoff wrote:
> On Tue, Mar 01, 2016 at 02:08:56PM +0000, Sébastien Delafond wrote:
> > On 2016-03-01, Mike Gabriel <sunweaver@debian.org> wrote:
> > > @Security Team: Shall we (LTS contributors) handle wheezy-security  
> > > updates like described below until Debian wheezy LTS comes into play?
> > >
> > >    o Pick a package that has open CVE issues in wheezy, e.g. from 
> > >      above list
> > >    o Add the package to data/dsa-needed.txt, if not already there:
> 
> Don't add anything to dsa-needed.txt directly, but rather ask team@ first 
> whether this actually qualifies for a DSA. Packages get only added there
> after individual assessment.

O.k. to grab lxc fixing CVE-2015-1335 to dsa-needed ?

Cheers,
 -- Guido

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web