Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #231287

Re: If some package have serious bug and fixed on unstable and testing release, how long it will be available on stable release?

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Sat, Jan 30, 2021 at 05:27:30AM +0000, Robbi Nespu wrote:
> Hi
> 
> On Fri, 29 Jan 2021 10:58:06 -0600, David Wright wrote:
> > https://security-tracker.debian.org/tracker/CVE-2021-3156
> > is a timely example of how Debian deals with such problems.
> > Note in particular the line
> > 
> >  stretch (security) 1.8.19p1-2.1+deb9u3 fixed
> > 
> > showing that stretch's version gets a fix, not an upgrade.
> 
> How you can confirm 1.8.19p1-2.1+deb9u3 fix CVE-2021-3156?
> 
> I could not see source code for that version here[1], I only can find
> 1.8.19p1-2.1+deb9u2 . Do source repository for security release are
> separated?
> 
> 1. https://sources.debian.org/src/sudo/

I subscribed to the debian security announce list, so I received a
security update announce about sudo a few days ago. You can find the web
archive of this email at this link [1].

As said in the email, you can find the detailed security status of sudo
in its security tracker page at: [2]

For the source code, I can also not find the 1.8.19p1-2.1+deb9u3
version, but I noticed that there is a 1.8.27-1+deb10u3 version [3].
This is the version mentioned in the security update announce, which is
suitable for the latest stable version (Debian 10)

[1] https://lists.debian.org/debian-security-announce/2021/msg00020.html
[2] https://security-tracker.debian.org/tracker/sudo
[3] https://sources.debian.org/src/sudo/1.8.27-1+deb10u3/

-- 
OpenPGP fingerprint: 3C47 5977 4819 267E DD64  C7E4 6332 5675 A739 C74E

Back to linux.debian.user | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

If some package have serious bug and fixed on unstable and testing  release, how long it will be available on stable release? Robbi Nespu <robbinespu@gmail.com> - 2021-01-29 03:20 +0100
  Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2021-01-29 13:40 +0100
  Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? Greg Wooledge <wooledg@eeg.ccf.org> - 2021-01-29 14:00 +0100
    Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? Robbi Nespu <robbinespu@gmail.com> - 2021-01-30 06:10 +0100
      Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? Greg Wooledge <wooledg@eeg.ccf.org> - 2021-02-01 14:00 +0100
  Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? David Wright <deblis@lionunicorn.co.uk> - 2021-01-29 18:00 +0100
    Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? Robbi Nespu <robbinespu@gmail.com> - 2021-01-30 06:50 +0100
      Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? Ming <ming@pgp.cool> - 2021-01-30 13:10 +0100
      Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? David Wright <deblis@lionunicorn.co.uk> - 2021-01-30 20:30 +0100

csiph-web