Re: golang-go.crypto / CVE-2019-11841

On Mon, Nov 9, 2020 at 10:33 PM Brian May wrote: > What is this "Built-Using" header? It documents which source package versions need to be shipped to ensure license compliance.

Re: samba backport from stable/testing to oldstable.

> oldstable (aka stretch) is now EOL'ed and has gone into the hands of > the LTS team. > Well, the good news is that Roberto (CC'ed here) is working on the > samba update to fix those vulnerabilities in stretch and I think it > should be rolled out really soon! Great, Thanks a lot Utkarsh for

LTS report for October 2020

Hours worked: 7 hours DLAs released: DLA-2422-1 qtsvg-opensource-src CVE-2018-19869 DLA-2423-1 wireshark CVE-2019-10894 CVE-2019-10895 CVE-2019-10896 CVE-2019-10899 CVE-2019-10901 CVE-2019-10903 CVE-2019-12295 DLA-2424-1 tzdata new upstream version for DST changes

Re: golang-go.crypto / CVE-2019-11841

Hi Brian, On Tue, Nov 10, 2020 at 4:03 AM Brian May wrote: > I might need help here: > > === cut === > Debian FTP Masters (28 mins. ago) () > Subject: rclone_1.35-1+deb8u1_amd64.changes REJECTED > To: d...@security.debian.org, b...@debian.org > Date: Mon, 09 Nov 2020 21:50:14 + > >

Re: samba backport from stable/testing to oldstable.

Hi Jaikumar, On Tue, Nov 10, 2020 at 9:34 AM Jaikumar Sharma wrote: > Does somebody know that there a plan to backport samba from stable or > testing to oldstable? As there are vulnerabilities in the samba in > oldstable. oldstable (aka stretch) is now EOL'ed and has gone into the hands of the

Re: golang-go.crypto / CVE-2019-11841

Brian May writes: > What is the process for rebuilding these in stretch LTS? Do I need to > add entries to dla-needed.txt and claim these entries? I might need help here: === cut === Debian FTP Masters (28 mins. ago) () Subject: rclone_1.35-1+deb8u1_amd64.changes REJECTED To:

[SECURITY] [DLA 2442-1] obfs4proxy security update

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 - - Debian LTS Advisory DLA-2442-1debian-...@lists.debian.org https://www.debian.org/lts/security/Brian May November 10, 2020

Accepted obfs4proxy 0.0.7-1+deb8u1 (source amd64) into oldstable

-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Format: 1.8 Date: Tue, 10 Nov 2020 08:27:43 +1100 Source: obfs4proxy Binary: obfs4proxy Architecture: source amd64 Version: 0.0.7-1+deb8u1 Distribution: stretch-security Urgency: medium Maintainer: Debian Privacy Tools Maintainers Changed-By:

Re: [SECURITY] [DLA 2441-1] sympa security update

On 2020-11-09 14:04:02, Sylvain Beucler wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA512 > > - - > Debian LTS Advisory DLA-2441-1debian-lts@lists.debian.org > https://www.debian.org/lts/security/

Re: Request for patch review (brotli)

On Sun, Oct 25, 2020 at 02:04:30PM -0400, Roberto C. Sánchez wrote: > Hi fellow LTS folks, > > I am working on the update for brotli as it relates to CVE-2020-8927. > The upstream Git project contains a commit [0] which fixes the issue > along with several other issues in the same commit.

[SECURITY] [DLA 2441-1] sympa security update

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 - - Debian LTS Advisory DLA-2441-1debian-...@lists.debian.org https://www.debian.org/lts/security/ November 09, 2020

Accepted sympa 6.2.16~dfsg-3+deb9u4 (source) into oldstable

-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 Format: 1.8 Date: Mon, 09 Nov 2020 12:12:41 +0100 Source: sympa Binary: sympa Architecture: source Version: 6.2.16~dfsg-3+deb9u4 Distribution: stretch-security Urgency: high Maintainer: Debian Sympa team Changed-By: Sylvain Beucler Description:

(semi-)automatic unclaim of packages with more than 2 weeks of inactivity (and missing DLAs on www.do)

hi, today two packages were unclaimed for LTS: - brotli (Roberto C. Sánchez) - zeromq3 (Adrian Bunk) and three for ELTS: - libdatetime-timezone-perl (Adrian Bunk) - tzdata (Adrian Bunk) - zeromq3 (Adrian Bunk) Related, Adrian Bunk probably claimed too many (4) packages: - cimg -