Hi,
On 29/09/2026 10:09, Mathias Behrle wrote:
* Sylvain Beucler: " Re: CVE triage for several issues in Tryton" (Mon, 21 Sep
2026 21:30:59 +0200):
On 21/09/2026 10:09, Mathias Behrle wrote:
* Sylvain Beucler: " Re: CVE triage for several issues in Tryton" (Sat, 19
Sep 2026 18:13:24 +0200):
I suggest you coordinate with the weasyprint maintainer to decide
whether to backport fixes/features, or try and bump the version in
bookworm.
Would it be allowed to have a newer version in bookworm than in stable?
No, because that would break dist upgrades.
However if you're going to fix this in bookworm it is expected that you
fix it in the other dists too :)
Special Debian version '-0+reallyX.Y.Z' (X.Y.Z being the new upstream
version) can also be used for such stable backports, depending on the
situation.
I had a second look at the weasyprint code and decided to adapt rather the
Tryton patch than the weasyprint code. The patch(es) for weasyprint would add
substantially more complexity than on the Tryton side and since the CVEs leading
to the changed code in weasyprint are marked as minor (no DSA) I guess it would
not be that simple to get that in Debian stable.
The result for bookworm is in the attached debdiff (and also on slasa in [1]).
The test suite is running smoothly. Please review and tell, if I can upload to
bookworm-security. I would like to ask the LTS team to do the paperwork.
[1]
https://salsa.debian.org/tryton-team/tryton-server/-/tree/debian-bookworm?ref_type=heads
Here's some review points:
- Clearly document the limits of the genshi fix in debian/changelog:
- "custom reports could fail, if they use the forbidden functions."
- not fixing the email templates, maybe used in custom modules (IIRC)
- Explicitly link the upstream Git commits from released branches
(current we have to dig fixes in the linked issues)
In particular in 10_restrict_weasyprint_protocols.patch:
Bug-Upstream: https://bugs.tryton.org/14907
-> Seems related to the other issue, not the weasyprint one.
None of the commits there match.
https://foss.heptapod.net/tryton/tryton/-/work_items/14947
-> still 404 hence should be documented as "private",
otherwise it just looks like a typo
Overall it seems you're adapting
https://foss.heptapod.net/tryton/tryton/-/commit/7c72806c98c07bb4ccb1f5f1b84954350541ec3a
(Incidentally, it doesn't help that the foss.heptapod.net refuses
https git clone, and that their Git mirror have an entirely
different set of Git commit IDs...)
- Still on weazyprint, did you check whether your weaysyprint fix
can be bypassed via
https://security-tracker.debian.org/tracker/CVE-2025-68616 ?
In which case we'll need to update weazyprint anyway.
We can update weasyprint/bookworm, after checking with
the maintainer. For trixie this may need a SPU indeed,
but if it's a pre-requisite of a tryton DSA, then maybe the
Security Team can fast-track it with a DSA too.
- Was there progress on attributing a TEMP for the weasyprint issue,
incidentally?
- Any reason to skip Salsa CI? It helps to have a look at the standard
Debian CI tests.
https://salsa.debian.org/tryton-team/tryton-server/-/commits/debian-bookworm
Otherwise this looks good.
Cheers!
Sylvain Beucler
Debian LTS Team
