Hi, There are two CVEs in NBD currently. One of them does not apply to stretch (it is in functionality introduced in NBD 3.16), but part of the other does.
I've prepared an update and pushed it to my repository at https://salsa.debian.org/wouter/nbd/-/tree/debian-stretch I've not yet tested this for the stretch version specifically, but the reporter wrote a script that exposes whether the bug is fixed; you can find it at https://lists.debian.org/nbd/2022/01/msg00037.html (you only need the second one; the first is the one that does not apply to stretch). Thanks, -- w@uter.{be,co.za} wouter@{grep.be,fosdem.org,debian.org}
