Re: rssh security update breaks rsync via Synology's "hyper backup"

2019-02-18 Thread Russ Allbery
Russ Allbery writes: > I'll follow up with the proposed diffs for stable and oldstable. Here are the proposed diffs for stable and oldstable. The stable diff just fixes the libssh2 interoperability regression. The oldstable diff fixes both that and the regression with downloading multiple file

Re: rssh security update breaks rsync via Synology's "hyper backup"

2019-02-18 Thread Russ Allbery
Roman Medina-Heigl Hernandez writes: > El 18/02/2019 a las 18:27, Russ Allbery escribió: >> While I agree that using undocumented features of rsync is a little >> dubious, I'm also willing to include a fix to allow the specific >> command line "rsync --server --daemon " since (a) it seems to be >

(early) monthly report

2019-02-18 Thread Antoine Beaupré
Hi all, Here's my early LTS report. The TL;DR: is: * website work * python-gpg * golang * libarchive * netmask * libreoffice * enigmail # Website work I again worked on the website this month, doing one more mass import ([MR 53][]) which was finally merged by Holger Levsen, after I [fixe

Re: rssh security update breaks rsync via Synology's "hyper backup"

2019-02-18 Thread Chris Lamb
Antoine Beaupré wrote: > > Does this plan sound good to everyone? I'll follow up with the proposed > > diffs for stable and oldstable. > > Works for me (LTS), although I won't be the one performing the upgrade > (I've unclaimed the package for other reasons). Works for me too and happy to take

heads up: DLA should now be published on the website

2019-02-18 Thread Antoine Beaupré
On 2019-02-01 20:58:28, Holger Levsen wrote: > On Fri, Feb 01, 2019 at 01:58:04PM -0500, Antoine Beaupré wrote: [...] > can you please put that on wiki.d.o/LTS/Development?! This is now done. I added a new section to the wiki https://wiki.debian.org/LTS/Development#Publishing_updates_on_the_web

Re: rssh security update breaks rsync via Synology's "hyper backup"

2019-02-18 Thread Antoine Beaupré
On 2019-02-18 09:27:37, Russ Allbery wrote: > Does this plan sound good to everyone? I'll follow up with the proposed > diffs for stable and oldstable. Works for me (LTS), although I won't be the one performing the upgrade (I've unclaimed the package for other reasons). Thanks for your work! A.

Re: rssh security update breaks rsync via Synology's "hyper backup"

2019-02-18 Thread Roman Medina-Heigl Hernandez
El 18/02/2019 a las 18:27, Russ Allbery escribió: > While I agree that using undocumented features of rsync is a little > dubious, I'm also willing to include a fix to allow the specific command > line "rsync --server --daemon " since (a) it seems to be safe, (b) > looks easy enough to do, and (c)

Re: rssh security update breaks rsync via Synology's "hyper backup"

2019-02-18 Thread Russ Allbery
Antoine Beaupré writes: > That said, if we do fix this in jessie, we should do it at the same time > as the regression identified in stretch (DSA-4377-2). > Russ, do you want to handle the Jessie update or should the LTS team do > it? > Should we wait for resolution on this issue before shippin

Re: Bug#922384: jessie-pu: package gsoap/2.8.17-1+deb8u2

2019-02-18 Thread Chris Lamb
[Adding 922...@bugs.debian.org to CC for completeness / BTS archive] Chris Lamb wrote: > > So using the ssize_t version that preserves the sizes of the arguments > > and return type of the function is the safer choice, regardless of > > upstream's claim that the function is private. > > Upstream

Re: Bug#922384: jessie-pu: package gsoap/2.8.17-1+deb8u2

2019-02-18 Thread Chris Lamb
Hi Mattias, > Is the aim of this discussion still to determine which version of the > proposed change to use? The original int version, or the updated > ssize_t version? I'm sorry to hear in your mail that you are feeling frustrated ("derail into a general complaint…" etc.) as our shared goal is

Re: Bug#922384: jessie-pu: package gsoap/2.8.17-1+deb8u2

2019-02-18 Thread Mattias Ellert
lör 2019-02-16 klockan 22:05 + skrev Ben Hutchings: > On Sat, 2019-02-16 at 06:43 +0100, Mattias Ellert wrote: > > lör 2019-02-16 klockan 00:12 +0100 skrev Chris Lamb: > > > Hi Mattias, > > > > > > > What exactly do you want to run past upstream? It is not clear to me > > > > what you are requ

Re: [SECURITY] [DLA 1680-1] tiff security update

2019-02-18 Thread Gerald Designergerald
Thank you merci Le Lun 18 Fév 2019 8:13, Brian May a écrit : > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Package: tiff > Version: 4.0.3-12.3+deb8u8 > CVE ID : CVE-2018-17000 CVE-2018-19210 CVE-2019-7663 > > > Brief introduction > > CVE-2018-17000 > > A NUL