Re: jquery / CVE-2020-7656

2020-06-09 Thread Chris Lamb
Hi Brian, > Have you considered the possibility of back porting the parseHTML > function? I did consider this. However, as I implied last time — and you have independently discovered! — Javascript development is very weird with lots of edge-cases, and that is before we consider the inconsistencie

Re: jquery / CVE-2020-7656

2020-06-09 Thread Brian May
"Chris Lamb" writes: > Brian, > >> Do we only need to filter out javascript if a selector is provided for >> some reason? > > Yes. Javascript development is fun. Oh, I see it in the docs. I don't know how I missed this before. From https://api.jquery.com/load/ "When calling .load() using a URL

Re: Refreshing mysql-connector-java

2020-06-09 Thread Moritz Muehlenhoff
On Tue, Jun 09, 2020 at 12:05:33PM +0200, Sylvain Beucler wrote: > Do you plan to send a DSA? Yeah, should go out tomorrow. Cheers, Moritz

Re: Refreshing mysql-connector-java

2020-06-09 Thread Sylvain Beucler
Hi Security Team, On 07/06/2020 09:44, Moritz Mühlenhoff wrote: > On Fri, Jun 05, 2020 at 02:27:50PM +0200, Sylvain Beucler wrote: >> On 05/06/2020 09:23, Sylvain Beucler wrote: >> I finished testing and I prepared the upload accordingly: >> >> https://www.beuc.net/tmp/debian-lts/mysql-connector-j

Re: Refreshing mysql-connector-java

2020-06-09 Thread Sylvain Beucler
Hi, On 07/06/2020 10:48, Salvatore Bonaccorso wrote: > On Fri, Jun 05, 2020 at 09:23:12AM +0200, Sylvain Beucler wrote: > [...] >> Hi Salvatore, >> >> On 04/06/2020 20:41, Salvatore Bonaccorso wrote: >>> On Mon, May 25, 2020 at 07:47:56PM +0200, Moritz Mühlenhoff wrote: On Mon, May 25, 2020 a

Re: unbound not supported

2020-06-09 Thread Sylvain Beucler
Hi, On 08/06/2020 23:13, Brian May wrote: > I notice that according to DSA-4694, unbound is not supported anymore in > Stretch. > > https://www.debian.org/security/2020/dsa-4694 > > Does this mean we should also mark it as unsupported in Jessie? I would say yes (we recently did the same with tor)