Bug#900920: stretch-pu: package freedink-dfarc/3.12-1+deb9u1
On Fri, 2018-06-08 at 20:12 +0200, Sylvain wrote:
> Hi,
>
> On 08/06/2018 19:55, Adam D. Barratt wrote:
> > Control: tags -1 + confirmed
> >
> > On Wed, 2018-06-06 at 19:54 +0200, beuc@debian.org wrote:
> > > Please consider this update to freedink-dfarc for stretch.
> > > It fixes a security issue that can overwrite arbitrary user
> > > files.
> > > Sending to stable following security team's directions from 2018-
> > > 06-
> > > 01.
> >
> > +freedink-dfarc (3.12-1+deb9u1) stable; urgency=high
> >
> > Please use "stretch" as the distribution.
> >
> > + * Fix directory traversal in D-Mod extractor (CVE-2018-0496)
> > + * Upload to 'stable' as security team rejected a DSA to
> > + 'stretch-security' (no justification)
> >
> > The changelog is not the place for such commentary - please remove
> > it.
> >
> > With the above changes made, and assuming that the resulting
> > package
> > has been tested on stretch, please feel free to upload.
>
> As per Social Contract #3 I do have to explain to my users why they
> get the security fix after the disclosure.
>
As with basically all core teams, Debian's security team is generally
stretched in terms of manpower and can't handle every possible update
that's security-related. Things have to be prioritised and sometimes
those updates end up being provided via proposed-updates. That's always
going to be the case in a volunteer project, and even larger and/or
commercially-backed projects will still have to decide which updates
they handle before others. This isn't a problem as such, just the way
things are.
(There's an argument that co-ordinated disclosure is in fact hiding
issues in and of itself. I don't particularly subscribe to that, nor do
I believe that any of this is what SC3 is actually trying to ensure.)
> This is not a commentary, this is purely factual.
It's not a description of a change made to the package, nor information
that users need in order to decide whether they should be installing
it. As such, it is commentary. That has nothing to do with its
factuality or otherwise.
Regards,
Adam
Reply to: