Re: Thoughts on Xen updates in LTS

2020-02-21 Thread Holger Levsen
On Fri, Feb 21, 2020 at 06:31:30PM -0500, Roberto C. Sánchez wrote: > > I just checked the lts git repo and the security tracker one, and there was > > no trace indicating that credativ was working on this, so I don't think > > an apology is needed/warranted here.. > Cool. I'm glad I didn't over

Re: Thoughts on Xen updates in LTS

2020-02-21 Thread Roberto C . Sánchez
On Fri, Feb 21, 2020 at 11:24:02PM +, Holger Levsen wrote: > Hi Roberto, > > besides what Moritz said... > > On Fri, Feb 21, 2020 at 01:37:14PM -0500, Roberto C. Sánchez wrote: > > > have you done this in coordination with credative who were working on > > > that before? > > I did not coordi

Re: Thoughts on Xen updates in LTS

2020-02-21 Thread Holger Levsen
Hi Roberto, besides what Moritz said... On Fri, Feb 21, 2020 at 01:37:14PM -0500, Roberto C. Sánchez wrote: > > have you done this in coordination with credative who were working on that > > before? > I did not coordinate with Credativ. In the past, the xen package always > showed as "claimed"

Re: Thoughts on Xen updates in LTS

2020-02-21 Thread Moritz Mühlenhoff
On Fri, Feb 21, 2020 at 01:37:14PM -0500, Roberto C. Sánchez wrote: > On Fri, Feb 21, 2020 at 05:56:33PM +, Holger Levsen wrote: > > Roberto, > > > > On Fri, Feb 21, 2020 at 12:33:12PM -0500, Roberto C. Sánchez wrote: > > > I have recently begun working on updates to xen in jessie. > > > > h

Re: Thoughts on Xen updates in LTS

2020-02-21 Thread Roberto C . Sánchez
On Fri, Feb 21, 2020 at 05:56:33PM +, Holger Levsen wrote: > Roberto, > > On Fri, Feb 21, 2020 at 12:33:12PM -0500, Roberto C. Sánchez wrote: > > I have recently begun working on updates to xen in jessie. > > have you done this in coordination with credative who were working on that > befor

Re: Thoughts on Xen updates in LTS

2020-02-21 Thread Holger Levsen
Roberto, On Fri, Feb 21, 2020 at 12:33:12PM -0500, Roberto C. Sánchez wrote: > I have recently begun working on updates to xen in jessie. have you done this in coordination with credative who were working on that before? -- cheers, Holger

Re: Bug#931376: debian-security-support: mention nodejs is not for untrusted content

2020-02-21 Thread Holger Levsen
On Fri, Feb 21, 2020 at 11:11:42AM +0100, Emilio Pozuelo Monfort wrote: > >> https://wiki.debian.org/LTS/Jessie > > > > oh, ic, I wasn't aware of this page (which exists since 2018) and I'm not > > sure > > I'm in favor of storing information in different places. > > > > I'm considering replaci

Re: Is it okay to bump dh-compat?

2020-02-21 Thread Roberto C . Sánchez
On Fri, Feb 21, 2020 at 10:37:06PM +0530, Utkarsh Gupta wrote: > Hi Roberto, > > On Fri, Feb 21, 2020 at 10:16 PM Roberto C. Sánchez > wrote: > > > Whilst working on libpam-radius-auth, I noticed that d/compat has > > > value "4" which throws the following error: > > > > > > dh_clean: error: Com

Thoughts on Xen updates in LTS

2020-02-21 Thread Roberto C . Sánchez
Hello all, I have recently begun working on updates to xen in jessie. First a small bit of history. The most recent update to xen in jessie was on 8th October 2019. The following morning, 9th October, it was triaged back into dla-needed.txt because of still open vulnerabilities. The package has

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

2020-02-21 Thread Holger Levsen
On Fri, Feb 21, 2020 at 11:14:35AM +0100, Emilio Pozuelo Monfort wrote: > Do you have python3-git installed? I made that dependency optional, so that if > you don't have it, the script will still work (but without the author info). thanks, this fixed this indeed. -- cheers, Holger

Re: Is it okay to bump dh-compat?

2020-02-21 Thread Holger Levsen
Hi Utkarsh, On Fri, Feb 21, 2020 at 10:37:06PM +0530, Utkarsh Gupta wrote: > Is it okay to add d/source/format file? Or should I instead be > applying patches via d/rules file? as a general rule: don't change the packaging when doing security updates. And mind you, some old packages don't have

Re: Is it okay to bump dh-compat?

2020-02-21 Thread Utkarsh Gupta
Hi Roberto, On Fri, Feb 21, 2020 at 10:16 PM Roberto C. Sánchez wrote: > > Whilst working on libpam-radius-auth, I noticed that d/compat has > > value "4" which throws the following error: > > > > dh_clean: error: Compatibility levels before 5 are no longer supported > > (level 4 requested) > > >

Re: Is it okay to bump dh-compat?

2020-02-21 Thread Emilio Pozuelo Monfort
On 21/02/2020 17:48, Emilio Pozuelo Monfort wrote: > On 21/02/2020 17:42, Utkarsh Gupta wrote: >> Hi all, >> >> Whilst working on libpam-radius-auth, I noticed that d/compat has >> value "4" which throws the following error: >> >> dh_clean: error: Compatibility levels before 5 are no longer support

Re: Is it okay to bump dh-compat?

2020-02-21 Thread Emilio Pozuelo Monfort
On 21/02/2020 17:42, Utkarsh Gupta wrote: > Hi all, > > Whilst working on libpam-radius-auth, I noticed that d/compat has > value "4" which throws the following error: > > dh_clean: error: Compatibility levels before 5 are no longer supported > (level 4 requested) > > Would it be okay to bump d/

Re: Is it okay to bump dh-compat?

2020-02-21 Thread Roberto C . Sánchez
On Fri, Feb 21, 2020 at 10:12:25PM +0530, Utkarsh Gupta wrote: > Hi all, > > Whilst working on libpam-radius-auth, I noticed that d/compat has > value "4" which throws the following error: > > dh_clean: error: Compatibility levels before 5 are no longer supported > (level 4 requested) > > Would

Is it okay to bump dh-compat?

2020-02-21 Thread Utkarsh Gupta
Hi all, Whilst working on libpam-radius-auth, I noticed that d/compat has value "4" which throws the following error: dh_clean: error: Compatibility levels before 5 are no longer supported (level 4 requested) Would it be okay to bump d/compat to 5 (or maybe 7) in such a case? Best, Utkarsh

Re: phppgadmin / CVE-2019-10784

2020-02-21 Thread Sylvain Beucler
Hi, On 21/02/2020 01:03, Ben Hutchings wrote: > On Thu, 2020-02-20 at 21:17 +0100, Ola Lundqvist wrote: >> I have started to look into CVE-2019-10784 for phppgadmin. >> >> After some thinking on how it would be possible to protect against this I'm >> starting to think about whether we really want

Re: (semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

2020-02-21 Thread Emilio Pozuelo Monfort
On 21/02/2020 00:34, Holger Levsen wrote: > Hi Emilio, > > On Wed, Feb 19, 2020 at 10:45:36AM +0100, Emilio Pozuelo Monfort wrote: >>> cd ~/Projects/security-tracker >>> git pull >>> cd ~/Projects/debian-www/webwml >>> git pull >>> ../cron/parts/10-check-ad

Re: Bug#931376: debian-security-support: mention nodejs is not for untrusted content

2020-02-21 Thread Emilio Pozuelo Monfort
On 20/02/2020 23:30, Holger Levsen wrote: > On Thu, Feb 20, 2020 at 07:50:30PM +0100, Markus Koschany wrote: >>> So we should add it to security-support-ended for those releases, and >>> let it be supported in buster. >> >> We currently also mention it here: >> https://wiki.debian.org/LTS/Jessie >

Re: ibus/CVE-2019-14822/glibc

2020-02-21 Thread Emilio Pozuelo Monfort
On 22/01/2020 07:29, Brian May wrote: > Brian May writes: > >> commit 7cba800a84730c9c5843acdd775e42b8c1438edf (HEAD) >> Author: Alexander Larsson >> Date: Mon Jun 1 10:02:47 2015 +0200 > > This patch decreases the number of errors from 1 to 52. Thanks for the investigation Brian. However af