Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1248933

Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2

From Moritz Mühlenhoff <jmm@inutil.org>
Newsgroups linux.debian.bugs.dist, linux.debian.devel.release
Subject Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2
Date 2025-06-03 23:10 +0200
Message-ID <KTH3r-7ZGP-7@gated-at.bofh.it> (permalink)
References <KRYUN-6HF0-1@gated-at.bofh.it> <KTtDb-7Hqj-1@gated-at.bofh.it> <KTyjv-7TZT-1@gated-at.bofh.it> <KRYUN-6HF0-1@gated-at.bofh.it> <KTyjv-7TZT-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

On Tue, Jun 03, 2025 at 01:33:44PM +0200, Daniel Leidert wrote:
> On Tue, 2025-06-03 at 08:42 +0200, Salvatore Bonaccorso wrote:
> > On Fri, May 30, 2025 at 05:38:30AM +0200, Daniel Leidert wrote:
> 
> [Bookworm PU for CVE-2025-47287.patch]
> > Technically we had the package already in mind for a DSA, so this
> > could as well go via a DSA (cc'ing my teammates from Debian security
> > team). One comment below:
> > 
> > > diff -Nru python-tornado-6.2.0/debian/patches/CVE-2023-28370.patch
> > > python-tornado-6.2.0/debian/patches/CVE-2023-28370.patch
> > > --- python-tornado-6.2.0/debian/patches/CVE-2023-
> > > 28370.patch	1970-01-01 01:00:00.000000000 +0100
> > > +++ python-tornado-6.2.0/debian/patches/CVE-2023-
> > > 28370.patch	2025-05-30 05:19:15.000000000 +0200
> > 
> > The patch seems wrongly named, should be CVE-2025-47287.patch instead
> > and samewise then in debian/patches/series to avoid confusion.
> 
> Thanks for catching that. Attached the debdiff after fixing the name.

We should rather fix this via a DSA. The debdiff looks fine, but please
change the target suite to bookworm-security and then build with -sa
for the upload to security-master (python-tornado is new in bookworm-security
and security.d.o and ftp.d.o don't share tarballs).

Cheers,
        Moritz

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2 Daniel Leidert <dleidert@debian.org> - 2025-05-30 05:50 +0200
  Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2 Salvatore Bonaccorso <carnil@debian.org> - 2025-06-03 08:50 +0200
    Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2 Daniel Leidert <dleidert@debian.org> - 2025-06-03 13:50 +0200
      Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2 Moritz Mühlenhoff <jmm@inutil.org> - 2025-06-03 23:10 +0200
        Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2 Daniel Leidert <dleidert@debian.org> - 2025-06-04 11:00 +0200
          Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2 Salvatore Bonaccorso <carnil@debian.org> - 2025-06-04 16:50 +0200
            Bug#1106819: bookworm-pu: package python-tornado/6.2.0-3+deb12u2 Daniel Leidert <dleidert@debian.org> - 2025-06-05 02:20 +0200

csiph-web