Your message dated Mon, 02 Nov 2026 02:34:34 +0000
with message-id <[email protected]>
and subject line Bug#1152371: fixed in oscar 2.1.0-3~exp1
has caused the Debian Bug report #1152371,
regarding oscar: unregistered vendor copy of botan
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1152371: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1152371
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: oscar
Version: 1.7.1-1
Severity: serious
Justification: vendors unfixed botan vulnerabilities
Tags: security
Cc: [email protected]
oscar builds a vendor copy of botan. This is problematic on several
levels. The Debian policy discourages embedded code copies and this
makes it a normal bug. A vulnerability in botan (which is a crypto
library after all) has to be fixed several times. Worse, one has to
figure out which packages include such a copy. Therefore, we keep a
record at
https://salsa.debian.org/security-tracker-team/security-tracker/-/blob/master/data/embedded-code-copies.
Notably, oscar is not listed here. The botan version included in oscar
is very old. It is very likely affected by a number of vulnerabilities
fixed in newer versions, see
https://security-tracker.debian.org/tracker/source-package/botan.
Beyond this, I attempted to cross build oscar and found that when
building it for s390x, it would fail with "error: writing 1 byte into a
region of size 0 [-Werror=stringop-overflow=]". This likely is due to
compiling with -Werror and gcc-16 having gained precision in warnings
(or false positives). I cannot reproduce this on amd64.
This bug report is about the unregistered and vulnerable vendor copy.
Please decide whether oscar has a good reason to vendor botan. If it
does, register your vendor copy with the security tracker and fix all
vulnerabilities (e.g. by updating the copy) and close this bug. If it
does not, please reuse the system copy.
Helmut
--- End Message ---
--- Begin Message ---
Source: oscar
Source-Version: 2.1.0-3~exp1
Done: Sergio Durigan Junior <[email protected]>
We believe that the bug you reported is fixed in the latest version of
oscar, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Sergio Durigan Junior <[email protected]> (supplier of updated oscar package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 01 Nov 2026 21:26:35 -0500
Source: oscar
Architecture: source
Version: 2.1.0-3~exp1
Distribution: experimental
Urgency: medium
Maintainer: Debian Med Packaging Team
<[email protected]>
Changed-By: Sergio Durigan Junior <[email protected]>
Closes: 1152371
Changes:
oscar (2.1.0-3~exp1) experimental; urgency=medium
.
* d/p/0004-Link-against-botan3.patch: Link against system botan3.
Needed because upstream ships an outdated version of botan which isn't
receiving security updates anymore. (Closes: #1152371)
* d/control: B-D on libbotan-3-dev.
Checksums-Sha1:
4c5449244dea751ba0811cb6f7cae7f2f3a75c2d 2158 oscar_2.1.0-3~exp1.dsc
087b4df8a414a78a353b3ec93a9821b5b772a26c 8336 oscar_2.1.0-3~exp1.debian.tar.xz
1e7d7da8dc4d203f0405f63213ab8672c096fccc 7289
oscar_2.1.0-3~exp1_source.buildinfo
Checksums-Sha256:
805340d60e3bd70d6e60f49b40a921ba41a9c831933350354ce07c5e5911cd12 2158
oscar_2.1.0-3~exp1.dsc
aa0a3b805cc84dcdc6e805dfc950c61761cce3ad826e9d73579bcc09ff83c755 8336
oscar_2.1.0-3~exp1.debian.tar.xz
3a57c037b1db6cc57454b85dd5647c777c851dd520406d4dec1ff7562e2a5d9f 7289
oscar_2.1.0-3~exp1_source.buildinfo
Files:
1ecb516d36b988431381fadf75d31f4e 2158 science optional oscar_2.1.0-3~exp1.dsc
2d1f51c1561549ecd6d169613a79a5e8 8336 science optional
oscar_2.1.0-3~exp1.debian.tar.xz
56c9807707971bf4c280ac13626e7f5b 7289 science optional
oscar_2.1.0-3~exp1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
wsG7BAEBCgBvBYJq5/UcCRDQ63YoZfxeNkcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmcNleZbEkwxbY+YXrZG6MUzcHs313R8rZJcg6+905CL
NRYhBCN6VLEChyi/AO8x9NDrdihl/F42AAC8bRAAg5JfS9s74QgunEBZcNwK75bd
6OmCn2XVJgj6d9L9a1FRQJqfrYNmOCJzsFdqD9T/Jgr+iYkOcfL7R9tCTj0bY05t
bLbmh593Fkj8lWmciPHiJAQhL3G3Enik4xjqAyIOv6LEuwj+v0c5fFPmpo8UhBKG
gYXVMB7PqNqEoyDN57NtEPOErE4NK6FCY78ZJqSHCUVa2D2g4Z5fqpEZ4Z/1BbXN
p3zptWj6HMQGMLdm77uO9XlhhSzj/XtA6TBWet7dn/kwRro9JCMK1SD790ivzRKP
aoqKwfasCCRwVWueMxNEkWY3sbSK9Hi1pKYdBdnN6wlUOdhLjbiNpJ6BkTFq7JTe
bbST+CvCxbTPbbGjucCqkHGFkGE6WFpwnlq8pC64PPKY1oh5UG+VeNZvhnvR7eWk
8Ve9genqTZ2bkRgVdEX5gBIESzjD+4/f0QFbzhVDbaiKa/cAW3aatsYppzFSOFHb
B03yaGxVKWUjQQq5TPP+MhOL7aW996D1efS+E8hbbb+pEWeZRcM3gF75deTepJ/I
mCEbMWNTppKqcDQefdKefkhKjMMrgR5nRXpWNuS580+Mkq/ur262PC6iVcrwaxaW
ocuMIyHQmfMpYCjRnnggpVagf/yBc19yXytbGL/Vjkx1Yt41uXa5pcs4tcnwLcLs
9n/UHHEAO+lFXy0VX3Y=
=w8HN
-----END PGP SIGNATURE-----
pgpubdq5eHq03.pgp
Description: PGP signature
--- End Message ---
