Le 05/03/2021 à 15:17, Roberto C. Sánchez a écrit : > On Fri, Mar 05, 2021 at 12:19:38PM +0100, Yadd wrote: >> Le 05/03/2021 à 11:38, Roberto C. Sánchez a écrit : >>> Xavier & Jonas, >>> >>> I sent the belwo query to [email protected] but >>> never received a response. Do you have any thoughts on this? >>> >>> Additionally, since it seems like making the fix too risky, I intent to >>> update the security tracker on Monday with a note like: "fix is likely >>> to break existing code; impact is too great". >>> >>> If I should wait on that, please let me know. >>> >>> Regards, >>> >>> -Roberto >>> >>> On Tue, Feb 23, 2021 at 07:17:59AM -0500, Roberto C. Sánchez wrote: >>>> Hello jQeury (and generally JS package) maintainers, >>>> >>>> [note: please CC me, as I am not subscribed to the list] >>>> >>>> I am part of the LTS team and at the request of a current LTS customer I >>>> have looked into fixing CVE-2020-11022 and CVE-2020-11023 in jQuery. In >>>> particular, the customer wanted to know if it was possible to fix those >>>> issues in stretch. Naturally, if those issues are fixed in stretch we >>>> would also like to see them fixed in buster so that a future stretch -> >>>> buster upgrade does not reintroduce the vulnerabilities. The issue is >>>> not so much technical as far as implementing the fix goes, but rather >>>> one of the consequences of making the change. >>>> >>>> Currently, the two CVEs are marked "<no-dsa> (Minor issue)" in the >>>> security tracker. So, the security team position on these issues is >>>> that they are not severe enough to warrant a DSA, which is why I am >>>> seeking your opinion/position on whether you would support fixing these >>>> issues via a stable update in the next point release. >>>> >>>> All of that said, I have backported the patches for the two referenced >>>> CVEs to the jquery version in stretch. The packages are available here: >>>> >>>> https://people.debian.org/~roberto/jquery/ >>>> >>>> The upstream patches applied cleanly in the portion which changed >>>> program code. The only areas which needed any manual tweaking were in >>>> the unit tests, which are not executed by debian/rules (though I did >>>> make an effort to correctly backport the changes to keep the unit test >>>> suite in a consistent state). >>>> >>>> Based on the release announcement [0] for the upstream jQuery version >>>> that fixed the vulnerabilities (version 3.5.0), the fix potentially >>>> breaks compatibility for existing code. This breaking of compatibility >>>> is the primary reason why I must ask you to provide an opinion or >>>> position on whether an update of jquery in buster would be something you >>>> would consider. As an additional consideration, the upstream release >>>> announcement describes workarounds for those who are unable to upgrade. >>>> >>>> If fixing the vulnerabilities in buster is not something you would >>>> consider, then we would also not proceed with fixing the vulnerabilities >>>> in stretch. If it is something you would consider, I could handle >>>> preparing the buster update and coordinate with the stable release >>>> managers for the upload. >>>> >>>> So, the questions are: >>>> >>>> - Would you support an update to jquery in buster to fix CVE-2020-11022 >>>> and CVE-2020-11022? >>>> - If yes, would you like for me to prepare the updated packages and >>>> coordinate with the SRMs for the upload to buster? >>>> >>>> Please advise on how I should or should not proceed. >>>> >>>> Regards, >>>> >>>> -Roberto >> >> Hi, >> >> sorry for the delay, please go ahead ;-) >> > To be clear, you find the benefit of fixing the two CVEs, CVE-2020-11022 > and CVE-2020-11023*, to outweight the potential risks and you agree that > I should coordinate with SRM for an update and buster (after which I > would also update in stretch)? > > Just making sure that I am not misunderstanding. > > Regards, > > -Roberto
Hi, yes, I saw your patches and it seems not risky to upload them so I fully agree with your proposition -- Pkg-javascript-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
