Gaps in security coverage?

From	John Goerzen <jgoerzen@complete.org>
Newsgroups	linux.debian.security
Subject	Gaps in security coverage?
Date	2018-11-05 15:30 +0100
Message-ID	<wQO37-64W-1@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Hi folks,

So I recently started running debsecan on one of my boxes.  It's a
fairly barebones server install, uses unattended-upgrades and is fully
up-to-date.  I expected a clean bill of health, but didn't get that.  I
got pages and pages and pages of output.  Some of it (especially kernel
related) I believe may be false positives, but not all.  Some of it
simply isn't patched yet.

Diving into it a bit, it seems that somehow we fell down a bit with
stretch.  The first hit on my list is this one:

https://security-tracker.debian.org/tracker/CVE-2011-5325

Marked fixed in jessie, vulnerable in stretch.  And indeed when looking
at the bug report 802702, I don't see any such changelog entries
pertaining to this in my stretch version.

So, the questions -

1) Is this a symptom of a bad process or of not enough volunteers?  In
other words, could we have marked these security bugs fixed in jessie as
RC for stretch somehow until they were also fixed there?

2) Is there a need for more help with security in general?  If so, what
kinds of volunteering would be appreciated?

Thanks,

John

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Gaps in security coverage? John Goerzen <jgoerzen@complete.org> - 2018-11-05 15:30 +0100
  Re: Gaps in security coverage? Paul Wise <pabs@debian.org> - 2018-11-06 02:40 +0100
    Re: Gaps in security coverage? John Goerzen <jgoerzen@complete.org> - 2018-11-06 04:00 +0100
      Re: Gaps in security coverage? Paul Wise <pabs@debian.org> - 2018-11-06 07:50 +0100
        Re: Gaps in security coverage? Paul Wise <pabs@debian.org> - 2018-11-06 12:10 +0100
          Re: Gaps in security coverage? Holger Levsen <holger@layer-acht.org> - 2018-11-06 12:50 +0100
        Re: Gaps in security coverage? Holger Levsen <holger@layer-acht.org> - 2018-11-06 12:10 +0100
    Re: Gaps in security coverage? Davide Prina <davide.prina@gmail.com> - 2018-11-06 20:20 +0100
  Re: Gaps in security coverage? Moritz Mühlenhoff <jmm@inutil.org> - 2018-11-06 23:30 +0100
    Re: Gaps in security coverage? Paul Wise <pabs@debian.org> - 2018-11-07 00:20 +0100

csiph-web