On Fri, Mar 05, 2021 at 05:05:13PM +0100, Yadd wrote: > Le 05/03/2021 à 15:17, Roberto C. Sánchez a écrit : > > On Fri, Mar 05, 2021 at 12:19:38PM +0100, Yadd wrote: > >> Le 05/03/2021 à 11:38, Roberto C. Sánchez a écrit : > >>> Xavier & Jonas, > >>> > >>> I sent the belwo query to [email protected] but > >>> never received a response. Do you have any thoughts on this? > >>> > >>> Additionally, since it seems like making the fix too risky, I intent to > >>> update the security tracker on Monday with a note like: "fix is likely > >>> to break existing code; impact is too great". > >>> > >>> If I should wait on that, please let me know. > >>> > >>> Regards, > >>> > >>> -Roberto > >>> > >>> On Tue, Feb 23, 2021 at 07:17:59AM -0500, Roberto C. Sánchez wrote: > >>>> Hello jQeury (and generally JS package) maintainers, > >>>> > >>>> [note: please CC me, as I am not subscribed to the list] > >>>> > >>>> I am part of the LTS team and at the request of a current LTS customer I > >>>> have looked into fixing CVE-2020-11022 and CVE-2020-11023 in jQuery. In > >>>> particular, the customer wanted to know if it was possible to fix those > >>>> issues in stretch. Naturally, if those issues are fixed in stretch we > >>>> would also like to see them fixed in buster so that a future stretch -> > >>>> buster upgrade does not reintroduce the vulnerabilities. The issue is > >>>> not so much technical as far as implementing the fix goes, but rather > >>>> one of the consequences of making the change. > >>>> > >>>> Currently, the two CVEs are marked "<no-dsa> (Minor issue)" in the > >>>> security tracker. So, the security team position on these issues is > >>>> that they are not severe enough to warrant a DSA, which is why I am > >>>> seeking your opinion/position on whether you would support fixing these > >>>> issues via a stable update in the next point release. > >>>> > >>>> All of that said, I have backported the patches for the two referenced > >>>> CVEs to the jquery version in stretch. The packages are available here: > >>>> > >>>> https://people.debian.org/~roberto/jquery/ > >>>> > >>>> The upstream patches applied cleanly in the portion which changed > >>>> program code. The only areas which needed any manual tweaking were in > >>>> the unit tests, which are not executed by debian/rules (though I did > >>>> make an effort to correctly backport the changes to keep the unit test > >>>> suite in a consistent state). > >>>> > >>>> Based on the release announcement [0] for the upstream jQuery version > >>>> that fixed the vulnerabilities (version 3.5.0), the fix potentially > >>>> breaks compatibility for existing code. This breaking of compatibility > >>>> is the primary reason why I must ask you to provide an opinion or > >>>> position on whether an update of jquery in buster would be something you > >>>> would consider. As an additional consideration, the upstream release > >>>> announcement describes workarounds for those who are unable to upgrade. > >>>> > >>>> If fixing the vulnerabilities in buster is not something you would > >>>> consider, then we would also not proceed with fixing the vulnerabilities > >>>> in stretch. If it is something you would consider, I could handle > >>>> preparing the buster update and coordinate with the stable release > >>>> managers for the upload. > >>>> > >>>> So, the questions are: > >>>> > >>>> - Would you support an update to jquery in buster to fix CVE-2020-11022 > >>>> and CVE-2020-11022? > >>>> - If yes, would you like for me to prepare the updated packages and > >>>> coordinate with the SRMs for the upload to buster? > >>>> > >>>> Please advise on how I should or should not proceed. > >>>> > >>>> Regards, > >>>> > >>>> -Roberto > >> > >> Hi, > >> > >> sorry for the delay, please go ahead ;-) > >> > > To be clear, you find the benefit of fixing the two CVEs, CVE-2020-11022 > > and CVE-2020-11023*, to outweight the potential risks and you agree that > > I should coordinate with SRM for an update and buster (after which I > > would also update in stretch)? > > > > Just making sure that I am not misunderstanding. > > > > Regards, > > > > -Roberto > > Hi, > > yes, I saw your patches and it seems not risky to upload them so I fully > agree with your proposition
Thanks for confirming! Regards, -Roberto -- Roberto C. Sánchez -- Pkg-javascript-devel mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
