Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.user > #231245 > unrolled thread

If some package have serious bug and fixed on unstable and testing release, how long it will be available on stable release?

Back to article view | Back to linux.debian.user

Contents

  If some package have serious bug and fixed on unstable and testing  release, how long it will be available on stable release? Robbi Nespu <robbinespu@gmail.com> - 2021-01-29 03:20 +0100
    Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? Eduardo M KALINOWSKI <eduardo@kalinowski.com.br> - 2021-01-29 13:40 +0100
    Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? Greg Wooledge <wooledg@eeg.ccf.org> - 2021-01-29 14:00 +0100
      Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? Robbi Nespu <robbinespu@gmail.com> - 2021-01-30 06:10 +0100
        Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? Greg Wooledge <wooledg@eeg.ccf.org> - 2021-02-01 14:00 +0100
    Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? David Wright <deblis@lionunicorn.co.uk> - 2021-01-29 18:00 +0100
      Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? Robbi Nespu <robbinespu@gmail.com> - 2021-01-30 06:50 +0100
        Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? Ming <ming@pgp.cool> - 2021-01-30 13:10 +0100
        Re: If some package have serious bug and fixed on unstable and  testing release, how long it will be available on stable release? David Wright <deblis@lionunicorn.co.uk> - 2021-01-30 20:30 +0100

#231245 — If some package have serious bug and fixed on unstable and testing release, how long it will be available on stable release?

Hello everyone,
I am curious something (as per title). I not sure whether to ask here or 
on devel mail list.

Yesterday on OFTC #debian, some guy ask about unfix CVE-2020-25681 to 
CVE-2020-25687 for dnsmasq[1] package on stable release.

I not using dnsmasq but I curious how and will it be backport to stable 
on cases like this?

Stable = 2.80-1 (vulnerable)
Testing = 2.83-1 (fix)
Unstable = 2.84-1 (fix)

There is 2 revision gap between stable and testing, do the security team 
will apply the fixes on 2.80-1 or will update the package rev up to 2.83-1?


1. https://security-tracker.debian.org/tracker/source-package/dnsmasq

-- 
Email: Robbi Nespu <robbinespu AT SPAMFREE gmail DOT com>
PGP fingerprint : D311 B5FF EEE6 0BE8 9C91 FA9E 0C81 FA30 3B3A 80BA
PGP key : https://keybase.io/robbinespu/pgp_keys.asc

[toc] | [next] | [standalone]

#231252 — Re: If some package have serious bug and fixed on unstable and testing release, how long it will be available on stable release?

On 28/01/2021 22:59, Robbi Nespu wrote:
> Hello everyone,
> I am curious something (as per title). I not sure whether to ask here 
> or on devel mail list.
>
> Yesterday on OFTC #debian, some guy ask about unfix CVE-2020-25681 to 
> CVE-2020-25687 for dnsmasq[1] package on stable release.
>
> I not using dnsmasq but I curious how and will it be backport to 
> stable on cases like this?
>
> Stable = 2.80-1 (vulnerable)
> Testing = 2.83-1 (fix)
> Unstable = 2.84-1 (fix)
>
> There is 2 revision gap between stable and testing, do the security 
> team will apply the fixes on 2.80-1 or will update the package rev up 
> to 2.83-1?
>
>
> 1. https://security-tracker.debian.org/tracker/source-package/dnsmasq
>
As a general rule, fixes are backported to the current version in stable.

If it's simply not possible or very costly, it might happen that a new 
version is introduced, but this is rare.

-- 
Programmers do it bit by bit.

Eduardo M KALINOWSKI
eduardo@kalinowski.com.br

[toc] | [prev] | [next] | [standalone]

#231253 — Re: If some package have serious bug and fixed on unstable and testing release, how long it will be available on stable release?

On Fri, Jan 29, 2021 at 09:59:37AM +0800, Robbi Nespu wrote:
> I am curious something (as per title).

Please do not put the content of your message in the Subject header.
There are multiple reasons:

1) The Subject header tends to get changed at some point, and then
   nobody in the thread from that point forward knows what the original
   Subject was.

2) Some people don't bother reading Subject headers, because they're
   often bunk.

3) A Subject header is too short to contain a proper question.  And/or,
   if your Subject header is very long, it may get truncated.

So, your Subject as received by me, after I un-mangle it, reads something
like this:

 If some package have serious bug and fixed on
 unstable and testing release, how long it will be available on stable
 release?

The answer to this question is: however long it takes for the current
testing to become stable.

A fix to a bug in Debian 11 as testing will NEVER be backported into
Debian 10 as stable.  A stable release is frozen in amber.  It only
gets security fixes, or major bug fixes.  Not general bug fixes.

[toc] | [prev] | [next] | [standalone]

#231285 — Re: If some package have serious bug and fixed on unstable and testing release, how long it will be available on stable release?

[Multipart message — attachments visible in raw view] — view raw

On Fri, 29 Jan 2021 07:55:30 -0500, Greg Wooledge wrote:
 > So, your Subject as received by me, after I un-mangle it, reads something
 > like this:
 >
 >  If some package have serious bug and fixed on
 >  unstable and testing release, how long it will be available on stable
 >  release?
Yes, this is the email title. Sorry for long title.

 > The answer to this question is: however long it takes for the current
 > testing to become stable.
If wait the current testing become stable and the current stable become 
old-stable. It will take very longer and the serious exploit wont be 
fix, if I take your sentence. It not what I understand and what I expect 
from Debian release since it recommend stable release for production.

 > A fix to a bug in Debian 11 as testing will NEVER be backported into
 > Debian 10 as stable.  A stable release is frozen in amber.  It only
 > gets security fixes, or major bug fixes.  Not general bug fixes.

The CVE is major bug and need security fix if you read my sentence 
previous.

It mentioned here[1] "At any given time, there is one stable release of 
Debian, which has the support of the Debian security team. When a new 
stable version is released, the security team will usually cover the 
previous version for a year or so, while they also cover the new/current 
version. Only stable is recommended for production use."

If I understand, It mean Buster (the current stable release) has the 
support of Debian security team and previous version (which mean stretch 
release), here. I expecting the fix also should be apply on stable. 
Please correct me if I read it wrong.

1. https://wiki.debian.org/DebianReleases
-- 
Email: Robbi Nespu <robbinespu AT SPAMFREE gmail DOT com>
PGP fingerprint : D311 B5FF EEE6 0BE8 9C91 FA9E 0C81 FA30 3B3A 80BA
PGP key : https://keybase.io/robbinespu/pgp_keys.asc

[toc] | [prev] | [next] | [standalone]

#231320 — Re: If some package have serious bug and fixed on unstable and testing release, how long it will be available on stable release?

On Sat, Jan 30, 2021 at 05:08:50AM +0000, Robbi Nespu wrote:
> On Fri, 29 Jan 2021 07:55:30 -0500, Greg Wooledge wrote:
> > So, your Subject as received by me, after I un-mangle it, reads something
> > like this:
> >
> >  If some package have serious bug and fixed on
> >  unstable and testing release, how long it will be available on stable
> >  release?
> Yes, this is the email title. Sorry for long title.
> 
> > The answer to this question is: however long it takes for the current
> > testing to become stable.
> If wait the current testing become stable and the current stable become
> old-stable. It will take very longer and the serious exploit wont be fix, if
> I take your sentence.

Stop.

You keep changing your words, and the words are extremely important here.

Originally you said "serious bug", and those may be fixed in a released
stable version, or they may not.  Most bugs are not fixed.  Some are.
I do not know where the Debian developers draw the line.

But all of a sudden now you are sayhing "serious exploit".

Security bugs DO get fixed.

Your change of wording has completely changed the question and therefore
the answer.

[toc] | [prev] | [next] | [standalone]

#231269 — Re: If some package have serious bug and fixed on unstable and testing release, how long it will be available on stable release?

On Fri 29 Jan 2021 at 09:59:37 (+0800), Robbi Nespu wrote:
> I am curious something (as per title). I not sure whether to ask here
> or on devel mail list.
> 
> Yesterday on OFTC #debian, some guy ask about unfix CVE-2020-25681 to
> CVE-2020-25687 for dnsmasq[1] package on stable release.
> 
> I not using dnsmasq but I curious how and will it be backport to
> stable on cases like this?
> 
> Stable = 2.80-1 (vulnerable)
> Testing = 2.83-1 (fix)
> Unstable = 2.84-1 (fix)
> 
> There is 2 revision gap between stable and testing, do the security
> team will apply the fixes on 2.80-1 or will update the package rev up
> to 2.83-1?
> 
> 1. https://security-tracker.debian.org/tracker/source-package/dnsmasq

https://security-tracker.debian.org/tracker/CVE-2021-3156
is a timely example of how Debian deals with such problems.
Note in particular the line

 stretch (security) 1.8.19p1-2.1+deb9u3 fixed

showing that stretch's version gets a fix, not an upgrade.

Cheers,
David.

[toc] | [prev] | [next] | [standalone]

#231286 — Re: If some package have serious bug and fixed on unstable and testing release, how long it will be available on stable release?

Hi

On Fri, 29 Jan 2021 10:58:06 -0600, David Wright wrote:
> https://security-tracker.debian.org/tracker/CVE-2021-3156
> is a timely example of how Debian deals with such problems.
> Note in particular the line
> 
>  stretch (security) 1.8.19p1-2.1+deb9u3 fixed
> 
> showing that stretch's version gets a fix, not an upgrade.

How you can confirm 1.8.19p1-2.1+deb9u3 fix CVE-2021-3156?

I could not see source code for that version here[1], I only can find 
1.8.19p1-2.1+deb9u2 . Do source repository for security release are 
separated?

1. https://sources.debian.org/src/sudo/
-- 
Email: Robbi Nespu <robbinespu AT SPAMFREE gmail DOT com>
PGP fingerprint : D311 B5FF EEE6 0BE8 9C91 FA9E 0C81 FA30 3B3A 80BA
PGP key : https://keybase.io/robbinespu/pgp_keys.asc

[toc] | [prev] | [next] | [standalone]

#231287 — Re: If some package have serious bug and fixed on unstable and testing release, how long it will be available on stable release?

[Multipart message — attachments visible in raw view] — view raw

On Sat, Jan 30, 2021 at 05:27:30AM +0000, Robbi Nespu wrote:
> Hi
> 
> On Fri, 29 Jan 2021 10:58:06 -0600, David Wright wrote:
> > https://security-tracker.debian.org/tracker/CVE-2021-3156
> > is a timely example of how Debian deals with such problems.
> > Note in particular the line
> > 
> >  stretch (security) 1.8.19p1-2.1+deb9u3 fixed
> > 
> > showing that stretch's version gets a fix, not an upgrade.
> 
> How you can confirm 1.8.19p1-2.1+deb9u3 fix CVE-2021-3156?
> 
> I could not see source code for that version here[1], I only can find
> 1.8.19p1-2.1+deb9u2 . Do source repository for security release are
> separated?
> 
> 1. https://sources.debian.org/src/sudo/

I subscribed to the debian security announce list, so I received a
security update announce about sudo a few days ago. You can find the web
archive of this email at this link [1].

As said in the email, you can find the detailed security status of sudo
in its security tracker page at: [2]

For the source code, I can also not find the 1.8.19p1-2.1+deb9u3
version, but I noticed that there is a 1.8.27-1+deb10u3 version [3].
This is the version mentioned in the security update announce, which is
suitable for the latest stable version (Debian 10)

[1] https://lists.debian.org/debian-security-announce/2021/msg00020.html
[2] https://security-tracker.debian.org/tracker/sudo
[3] https://sources.debian.org/src/sudo/1.8.27-1+deb10u3/

-- 
OpenPGP fingerprint: 3C47 5977 4819 267E DD64  C7E4 6332 5675 A739 C74E

[toc] | [prev] | [next] | [standalone]

#231291 — Re: If some package have serious bug and fixed on unstable and testing release, how long it will be available on stable release?

On Sat 30 Jan 2021 at 05:27:30 (+0000), Robbi Nespu wrote:
> On Fri, 29 Jan 2021 10:58:06 -0600, David Wright wrote:
> > https://security-tracker.debian.org/tracker/CVE-2021-3156
> > is a timely example of how Debian deals with such problems.
> > Note in particular the line
> > 
> >  stretch (security) 1.8.19p1-2.1+deb9u3 fixed
> > 
> > showing that stretch's version gets a fix, not an upgrade.
> 
> How you can confirm 1.8.19p1-2.1+deb9u3 fix CVE-2021-3156?

The changelog, /usr/share/doc/sudo/changelog.Debian.gz, starts with:

  sudo (1.8.19p1-2.1+deb9u3) stretch-security; urgency=high

    * Non-maintainer upload by the Security Team.
    * Heap-based buffer overflow (CVE-2021-3156)
      - Reset valid_flags to MODE_NONINTERACTIVE for sudoedit
      - Add sudoedit flag checks in plugin that are consistent with front-end
      - Fix potential buffer overflow when unescaping backslashes in user_args
      - Fix the memset offset when converting a v1 timestamp to TS_LOCKEXCL
      - Don't assume that argv is allocated as a single flat buffer

   -- Salvatore Bonaccorso <[…]>  Sat, 23 Jan 2021 10:10:33 +0100

> I could not see source code for that version here[1], I only can find
> 1.8.19p1-2.1+deb9u2 . Do source repository for security release are
> separated?

Yes, the sources are for the current distribution, buster. As for
binaries, deb.debian.org/debian will carry the latest point release.
You need to make sure you have security.debian.org/debian-security
in your sources.list so that you receive all the security updates.

The new source is not normally available as such, but as a cumulative
set of patches. So that would be sudo_1.8.19p1-2.1+deb9u3.debian.tar.xz
for stretch.

It can sometimes be confusing for those not used to the Debian Way,
who might judge the security of a package from only the upstream
version number (ie before the hyphen).

> 1. https://sources.debian.org/src/sudo/

Cheers,
David.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.user

csiph-web