Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #238140

Re: runc CVEs in docker.io

Show all headers | View raw

Gareth Evans schrieb:

> Given that these are all fixed in Bullseye (and at least the grave
> apt-listbugs issue has been fixed in eg Ubuntu since March 2020 [1])
> why not also Buster?
[...]
> According to 
> 
> https://tracker.debian.org/pkg/runc
> 
> there are 3 open security issues in (Stretch and) Buster

Most are marked "vulnerable (no DSA)". According to
<https://security-team.debian.org/triage.html> and
<https://security-team.debian.org/security_tracker.html#issues-not-warranting-a-security-advisory>,
that may mean that minor issues will be fixed with a point update or
"are simply not worth fixing in a stable release".

CVE-2021-30465 is scheduled to get a security update for buster.

> (though I
> imagine Debian's support for Stretch has ended with EOL in 2020?) -

Stretch will get security support via the Debian LTS project
(<https://wiki.debian.org/LTS>) until the end of June, 2022.

Debian Jessie still gets some security support via the Debian ELTS
project (<https://wiki.debian.org/LTS/Extended>) for the same time
period. Most probably the same will happen for Stretch after LTS
support has ended.

-thh

Back to linux.debian.user | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

runc CVEs in docker.io "Gareth Evans" <donotspam@fastmail.fm> - 2021-07-27 18:10 +0200
  Re: runc CVEs in docker.io Dominique Dumont <dod@debian.org> - 2021-08-02 12:50 +0200
    Re: runc CVEs in docker.io "Gareth Evans" <donotspam@fastmail.fm> - 2021-08-04 14:50 +0200
      Re: runc CVEs in docker.io Dominique Dumont <dominique.dumont@netc.fr> - 2021-08-07 16:30 +0200
  Re: runc CVEs in docker.io Thomas Hochstein <thh@thh.name> - 2021-08-04 18:40 +0200

csiph-web