Another story is bullseye, that one is affected as well but a backport
there is even harder. For now I have marked it as well no-dsa in the
security-tracker, but maybe it should be <ignored> with mentioning
that backporting patches is too intrusive?
Regarding the version in bullseye: upstream has kindly shared with me a
set of patches. I've pushed them to:
https://salsa.debian.org/debian/freeradius/-/tree/wip/debian/blastradius/bullseye.
While they build, I haven't been able to test them (yet). The
autopkgtest job fails, but that is related to a bug in Salsa CI and
systemd when tmp.mount is masked.
Bernhard, are you able to test them? I do not have any experience with
FreeRADIUS, so I could test them, but I would take me some time. Just
let me know if help is needed here.
Cool, unfortunately I'm off to vacation tomorrow and I'm not sure how
much I can do before. I'll be back on August 20th.
So, if I understood you correctly, the plan is to use Bastien's
backported patches in
https://salsa.debian.org/debian/freeradius/-/tree/wip/debian/blastradius/bullseye
and update the version in bookworm to the current trixie version, both
in a point release?
I can test drive the bulleye version on one of our production servers
after 20th, and I can certainly ask in the higher education group in
Germany who can test either locally available .debs or better use
-proposed uploads before the point release.
Do we have a date for the next point release already?
Bernhard
