Bug#1072300: marked as done (RM: phppgadmin -- RoM; security issues; incompatible with bookworm's PostgreSQL version)

Debian Bug Tracking System Sat, 29 Jun 2024 01:09:49 -0700

Your message dated Sat, 29 Jun 2024 08:07:50 +0000
with message-id <e1snt7e-007zzq...@fasolo.debian.org>
and subject line Bug#1072300: Removed package(s) from stable
has caused the Debian Bug report #1072300,
regarding RM: phppgadmin -- RoM; security issues; incompatible with bookworm's 
PostgreSQL version
to be marked as done.


This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)


-- 
1072300: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1072300
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems

--- Begin Message ---

Package: release.debian.org
Control: affects -1 + src:phppgadmin
X-Debbugs-Cc: phppgad...@packages.debian.org
User: release.debian....@packages.debian.org
Usertags: rm
X-Debbugs-Cc: leandrocunha...@gmail.com
Severity: normal

Reason and request
I open this bug to request the removal of the phppgadmin package
version 7.13.0+dfsg-2 from the current stable version of Debian
codenamed bookworm, the motivation for this would be two serious CVEs
according to NVD, problem with the connection in the current version
of PostgreSQL 15 present in bookworm and several bugs present in this
version of phpPgAdmin. Such bugs and CVEs were fixed in the version
present in bookworm-backports, unstable and testing (trixie).
According to the email exchange made on the bugs, the security team
and the PostgreSQL team of the Debian Project agree to the removal of
this package in bookworm. We have a unanimity here.

Bugs and CVEs

phppgadmin: CVE-2023-40619
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1053004

phppgadmin: CVE-2019-10784
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=953945

NOTE: With these two serious CVEs, the package was removed from
testing because they were release critical bugs and this made me ask
to upload version 7.14.7+dfsg-1 to unstable and later to testing.

phppgadmin: postgresql-15 not supported
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1029516

NOTE: PostgreSQL 15 version present in stable. See
https://tracker.debian.org/pkg/postgresql-15

And other bugs fixed in 7.14.7+dfsg-1 and 7.14.7+dfsg-1~bpo12+1.

--- End Message ---

--- Begin Message ---

We believe that the bug you reported is now fixed; the following
package(s) have been removed from stable:

phppgadmin | 7.13.0+dfsg-2 | source, all

------------------- Reason -------------------
RoM; security issues; incompatible with bookworm PostgreSQL version
----------------------------------------------

Note that the package(s) have simply been removed from the tag
database and may (or may not) still be in the pool; this is not a bug.
The package(s) will be physically removed automatically when no suite
references them (and in the case of source, when no binary references
it).  Please also remember that the changes have been done on the
master archive and will not propagate to any mirrors until the next
dinstall run at the earliest.

Packages are usually not removed from testing by hand. Testing tracks
unstable and will automatically remove packages which were removed
from unstable when removing them from testing causes no dependency
problems. The release team can force a removal from testing if it is
really needed, please contact them if this should be the case.

Bugs which have been reported against this package are not automatically
removed from the Bug Tracking System.  Please check all open bugs and
close them or re-assign them to another package if the removed package
was superseded by another one.

The version of this package that was in Debian prior to this removal
can still be found using https://snapshot.debian.org/.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1072...@bugs.debian.org.

The full log for this bug can be viewed at https://bugs.debian.org/1072300

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmas...@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Archive Administrator (the ftpmaster behind the curtain)

pgp9R9O4nVF9a.pgp
Description: PGP signature

--- End Message ---

Bug#1072300: marked as done (RM: phppgadmin -- RoM; security issues; incompatible with bookworm's PostgreSQL version)

Reply via email to