[Git][security-tracker-team/security-tracker][master] lts: move some packages to bookworm only
Emilio Pozuelo Monfort (@pochu)
pochu at debian.org
Tue Sep 1 13:33:58 BST 2026
Emilio Pozuelo Monfort pushed to branch master at Debian Security Tracker / security-tracker
Commits:
349a36ea by Emilio Pozuelo Monfort at 2026-09-01T14:33:30+02:00
lts: move some packages to bookworm only
- - - - -
1 changed file:
- data/dla-needed.txt
Changes:
=====================================
data/dla-needed.txt
=====================================
@@ -25,17 +25,17 @@ To make it easier to see the entire history of an update, please append notes
rather than remove/replace existing ones.
--
-389-ds-base
+389-ds-base/bookworm
NOTE: 20260413: Added by Front-Desk (rouca)
NOTE: 20260413: Try to clean postponed CVE (rouca/FD)
NOTE: 20260715: Also add for bookworm; upcoming DSA (Beuc/front-desk)
--
-activemq
+activemq/bookworm
NOTE: 20260413: Added by Front-Desk (rouca)
NOTE: 20260715: Also add for bookworm
NOTE: 20260715: Upcoming DSA, though they may just bump version (Beuc/front-desk)
--
-adminer
+adminer/bookworm
NOTE: 20260801: Added by Front-Desk (ta)
--
amd64-microcode
@@ -84,7 +84,7 @@ ca-certificates
NOTE: 20260710: bookworm update seems to be required: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1107237#48 (santiago)
NOTE: 20260810: made a release from trixie DLA-4726-1 (rouca). Will need last sid version to go to trixie (rouca)
--
-cacti
+cacti/bookworm
NOTE: 20260630: Added by Front-Desk (dleidert)
NOTE: 20260630: A new bunch of issues and in DSA list (dleidert/front-desk)
--
@@ -92,14 +92,14 @@ caddy/bookworm
NOTE: 20260715: Added by Front-Desk (Beuc)
NOTE: 20260715: Upcoming DSA (Beuc/front-desk)
--
-cjson
+cjson/bookworm
NOTE: 20260801: Added by Front-Desk (ta)
--
clamav (Emilio)
NOTE: 20260711: Added by Front-Desk (utkarsh)
NOTE: 20260711: Needs a newer rustc to be backported as well. (utkarsh)
--
-cockpit
+cockpit/bookworm
NOTE: 20260819: Added by Front-Desk (lamby)
--
composer
@@ -116,11 +116,11 @@ cups (Thorsten Alteholz)
NOTE: 20260615: bookworm also need the same fixes as bullseye. (charles)
NOTE: 20260705: still trying to find a solution to fix a CVE without changing the functionality of lpadmin
--
-cyrus-imapd
+cyrus-imapd/bookworm
NOTE: 20260717: Added by Front-Desk (Beuc)
NOTE: 20260717: Upcoming DSA (Beuc/front-desk)
--
-designate
+designate/bookworm
NOTE: 20260818: Added by Front-Desk (lamby)
NOTE: 20260823: Maintainer uploaded fixes for bookworm. (Charles)
--
@@ -132,7 +132,7 @@ dovecot
NOTE: 20260829: Added by Front-Desk (dleidert)
NOTE: 20260829: Upcoming DSA (dleidert/front-desk)
--
-dracut
+dracut/bookworm
NOTE: 20260611: Added by Front-Desk (rouca)
NOTE: 20260611: Please investigate impact of legacy network on older release of dracut aka CVE-2026-6893 (rouca/FD)
--
@@ -184,7 +184,7 @@ flatpak
NOTE: 20260811: chained to RCE. In DSA needed, maintainer taking care of
NOTE: 20260811: trixie update, follow DSA. (charles)
--
-freecad
+freecad/bookworm
NOTE: 20260821: Added by Front-Desk (lamby)
--
freerdp2
@@ -200,7 +200,7 @@ frr
gawk
NOTE: 20260801: Added by Front-Desk (ta)
--
-gegl
+gegl/bookworm
NOTE: 20260821: Added by Front-Desk (lamby)
NOTE: 20260821: Not immediately clear how the changes to libs/ctx/ctx.h (not present in bullseye LTS) interact with libs/rgbe/rgbe.c, so this may not be vulnerable in bullseye or earlier. (lamby)
--
@@ -208,7 +208,7 @@ gh/bookworm
NOTE: 20241230: Added by Security Team (carnil)
NOTE: 20260611: bookworm LTS handover.
--
-gimp
+gimp/bookworm
NOTE: 20260709: Added by Front-Desk (utkarsh)
NOTE: 20260709: PSP/PNM/PSD parser overflows CVE-2026-58379..58388 (crafted image); TIM-loader
NOTE: 20260709: CVE-2026-59089 not-affected (GIMP 3.x-only).
@@ -236,7 +236,7 @@ inkscape/bookworm
NOTE: 20260522: Added by Security Team (jmm)
NOTE: 20260611: bookworm LTS handover.
--
-ironic
+ironic/bookworm
NOTE: 20260610: Added by Front-Desk (rouca)
NOTE: 20260816: Partial release by maintainer (charles)
--
@@ -244,7 +244,7 @@ isc-kea/bookworm
NOTE: 20260224: Added by Security Team (jmm)
NOTE: 20260611: bookworm LTS handover.
--
-jackson-databind
+jackson-databind/bookworm
NOTE: 20260709: Added by Front-Desk (utkarsh)
NOTE: 20260709: CVE-2026-54512/54513/54514/54515 hit 2.12(bullseye)+2.14(bookworm);
NOTE: 20260709: 54516/54517/54518 (>=2.21) and 50193 (bookworm 2.14) not-affected.
@@ -255,17 +255,17 @@ jbig2dec
jetty9
NOTE: 20260418: Added by Front-Desk. Fix CVE-2026-5795 maybe other (rouca)
--
-jline3
+jline3/bookworm
NOTE: 20260801: Added by Front-Desk (ta)
--
jpeg-xl/bookworm
NOTE: 20260619: Added by Front-Desk (charles)
NOTE: 20260619: Follow DSA-6342-1 (charles)
--
-kamailio
+kamailio/bookworm
NOTE: 20260413: Added by Front-Desk (rouca)
--
-keystone
+keystone/bookworm
NOTE: 20260830: Added by Front-Desk (dleidert)
NOTE: 20260830: Upcoming DSA (dleidert/front-desk)
--
@@ -317,7 +317,7 @@ libio-compress-perl
NOTE: 20260612: Added by Front-Desk (rouca)
NOTE: 20260612: MUST hold-back following the upper suites and wait for green light from security team (rouca/FD)
--
-libmojo-jwt-perl
+libmojo-jwt-perl/bookworm
NOTE: 20260805: Added by Front-Desk (rouca)
--
librest
@@ -328,7 +328,7 @@ libreswan/bookworm
NOTE: 20260611: bookworm LTS handover.
NOTE: 20260611: Sync with maintainer (dkg), hard to test.
--
-libsoup2.4
+libsoup2.4/bookworm
NOTE: 20250408: Added by Front-Desk (Beuc)
NOTE: 20250427: libsoup2.4 2.72.0-2+deb11u2 (bullseye) uploaded ...
NOTE: 20250427: ... without CVE-2025-32907 and CVE-2025-32049.
@@ -383,7 +383,7 @@ libwebsockets/bookworm
NOTE: 20260718: Added by Front-Desk (Beuc)
NOTE: 20260718: 2 CVEs fixed in both bullseye and trixie (Beuc/front-desk)
--
-linux (Ben Hutchings)
+linux/bookworm (Ben Hutchings)
NOTE: 20230111: Perma-added, Linux package specifically delegated to bwh (LTS Team)
--
logback
@@ -404,7 +404,7 @@ lrzip/bookworm
lxml
NOTE: 20260614: Added by Front-Desk (rouca)
--
-mediawiki
+mediawiki/bookworm
NOTE: 20260713: Added by Front-Desk (Beuc)
NOTE: 20260713: Follow DSA-6380-1 (10 CVEs) (Beuc/front-desk)
--
@@ -413,14 +413,14 @@ memcached/bookworm
NOTE: 20260717: Follow DLA-4601-1/bullseye (2 CVEs)
NOTE: 20260717: Fix other postponed issues while we're at it (Beuc/front-desk)
--
-mistral
+mistral/bookworm
NOTE: 20260612: Added by Front-Desk (rouca)
--
nats-server/bookworm
NOTE: 20260715: Added by Front-Desk (Beuc)
NOTE: 20260715: Upcoming DSA (Beuc/front-desk)
--
-netty (rouca)
+netty/bookworm (rouca)
NOTE: 20250814: Added by Front-Desk (lamby)
NOTE: 20251115: Partial release for sid. Fix all CVEs except CVE-2025-58056 (rouca)
NOTE: 20251127: all CVEs fixed under sid (rouca)
@@ -439,14 +439,14 @@ node-dompurify/bookworm
NOTE: 20260715: Added by Front-Desk (Beuc)
NOTE: 20260715: Upcoming DSA (Beuc/front-desk)
--
-node-ip-address
+node-ip-address/bookworm
NOTE: 20260804: Added by Front-Desk (rouca)
--
node-lodash/bookworm (utkarsh)
NOTE: 20260703: Added by Front-Desk (dleidert)
NOTE: 20260703: Follow DLA 4663-1; assigned to Utkarsh to grab this (dleidert/front-desk)
--
-node-re2
+node-re2/bookworm
NOTE: 20260806: Added by Front-Desk (rouca)
NOTE: 20260806: CVE-2026-68499 is worth fixing due to re2 used for fixing redos and other regex problem on backport (rouca)
--
@@ -464,7 +464,7 @@ openexr
NOTE: 20260413: Added by Front-Desk (rouca)
NOTE: 20260713: Also add for bookworm (Beuc/front-desk)
--
-openimageio
+openimageio/bookworm
NOTE: 20260726: Added by Front-Desk (utkarsh)
NOTE: 20260726: Six memory-corruption flaws in image readers that are
NOTE: 20260726: built by default and reached by decoding an untrusted
@@ -494,10 +494,10 @@ pacemaker
NOTE: 20260618: Added by Front-Desk (charles)
NOTE: 20260618: Package is in dsa-needed (charles)
--
-pcp
+pcp/bookworm
NOTE: 20260801: Added by Front-Desk (ta)
--
-pdfminer
+pdfminer/bookworm
NOTE: 20260715: Added by Front-Desk (Beuc)
NOTE: 20260715: CVE-2025-70559 is follow-up fix for CVE-2025-64512
NOTE: 20260715: Upcoming DSA (Beuc/front-desk)
@@ -506,17 +506,17 @@ perl
NOTE: 20260527: Added by Front-Desk (santiago)
NOTE: 20260527: wait for the DSA before releasing
--
-pgextwlist
+pgextwlist/bookworm
NOTE: 20260714: Added by Front-Desk (Beuc)
NOTE: 20260714: Follow DSA-6385-1 (1 CVE) (Beuc/front-desk)
--
-pglogical
+pglogical/bookworm
NOTE: 20260805: Added by Front-Desk, due to CVE-2026-50738 (rouca)
--
-php-dompdf
+php-dompdf/bookworm
NOTE: 20260804: Added by Front-Desk (rouca)
--
-php-laravel-framework
+php-laravel-framework/bookworm
NOTE: 20250307: Added by Front-Desk (rouca)
NOTE: 20251027: History of upstream branch fixing v12: git log 9de75259..2d133034^2.
NOTE: 20251027: There was an attempt to backport to v9, but it got rejected upstream
@@ -534,10 +534,10 @@ proftpd-dfsg
NOTE: 20260511: https://salsa.debian.org/debian-proftpd-team/proftpd/-/commits/bullseye
NOTE: 20260715: Also add for bookworm; upcoming DSA (Beuc/front-desk)
--
-puma
+puma/bookworm
NOTE: 20260804: Added by Front-Desk (rouca)
--
-py7zr
+py7zr/bookworm
NOTE: 20260709: Added by Front-Desk (utkarsh)
NOTE: 20260709: CVE-2026-23879 (GHSA range <=1.1.2); Debian 0.11.3 in range.
--
@@ -549,7 +549,7 @@ python-aiohttp (dleidert)
NOTE: 20260611: Added by Front-Desk (rouca)
NOTE: 20260602: Daniel Leidert is proposing to work on the update and provide debdiffs for bookworm and trixie (carnil)
--
-python-asyncssh
+python-asyncssh/bookworm
NOTE: 20260806: Added by Front-Desk (rouca)
--
python-cryptography
@@ -567,7 +567,7 @@ python-geopandas/bookworm
NOTE: 20260725: Should be fixed for trixie too, which still ships an
NOTE: 20260725: affected 1.0.1-2. (utkarsh/front-desk)
--
-python-git
+python-git/bookworm
NOTE: 20260726: Added by Front-Desk (utkarsh)
NOTE: 20260726: CVE-2026-42215 bypasses the check_unsafe_options guard
NOTE: 20260726: that DLA-3939-1 itself backported, so our own earlier fix
@@ -593,7 +593,7 @@ python-tornado
NOTE: 20260722: Extend to bullseye; CVE-2026-49853/49854/49855 in 6.1.0 too,
NOTE: 20260722: shared with bookworm; fix in 6.5.6 (utkarsh/front-desk)
--
-python-zeroconf
+python-zeroconf/bookworm
NOTE: 20260804: Added by Front-Desk (rouca)
--
qemu
@@ -610,13 +610,13 @@ rsync (Thorsten Alteholz)
NOTE: 20260615: Requested by Sylvain to track regressions, same as in dsa-needed. (charles)
NOTE: 20260705: making progress with updated patches
--
-ruby-jwt
+ruby-jwt/bookworm
NOTE: 20260805: Added by Front-Desk (rouca)
--
-ruby-oauth2
+ruby-oauth2/bookworm
NOTE: 20260805: Added by Front-Desk (rouca)
--
-ruby-oj
+ruby-oj/bookworm
NOTE: 20260709: Added by Front-Desk (utkarsh)
NOTE: 20260709: Oj JSON parser memory-safety batch CVE-2026-54500..54903 (GHSA); affects 2.17-3.14.
--
@@ -641,14 +641,14 @@ runc
NOTE: 20260223: Updated #1120140 with some thoughts, asking for more opinions (kanashiro)
NOTE: 20260706: Please handle Bookworm as well (dleidert/front-desk)
--
-sabnzbdplus
+sabnzbdplus/bookworm
NOTE: 20260830: Added by Front-Desk (dleidert)
NOTE: 20260830: Follow DSA 6454-1 (dleidert/front-desk)
--
samba (Markus Koschany)
NOTE: 20260809: Added by Front-Desk (rouca)
--
-shiro
+shiro/bookworm
NOTE: 20260726: Added by Front-Desk (utkarsh)
NOTE: 20260726: CVE-2026-56091: SimpleFilterChainResolver in shiro-guice
NOTE: 20260726: does not normalise a trailing slash, so a request for
@@ -688,11 +688,11 @@ sssd
NOTE: 20260804: Crash or DoS of sssd may lead to user lockdown (rouca/FD)
NOTE: 20260804: SSSD should be tested carefully, with integration test (rouca/FD)
--
-suricata-update
+suricata-update/bookworm
NOTE: 20260830: Added by Front-Desk (dleidert)
NOTE: 20260830: Follow DSA-6475-1 (dleidert/front-desk)
--
-swift
+swift/bookworm
NOTE: 20260726: Added by Front-Desk (utkarsh)
NOTE: 20260726: CVE-2026-50221: proxy gatekeeper does not strip the
NOTE: 20260726: X-Container-Host/X-Delete-At-Host update headers from
@@ -721,7 +721,7 @@ unbound
NOTE: 20260520: 11 new CVEs including 2 memory corruption (Beuc/front-desk)
NOTE: 20260611: For bookworm, sync with maintainer (Michael Tokarev) who had looked into initial backport.
--
-urwid
+urwid/bookworm
NOTE: 20260802: Added by Front-Desk (ta)
NOTE: 20260802: not the same code but the same reasoning (ta)
--
@@ -736,7 +736,7 @@ vim (lee)
NOTE: 20260228: useful to spot regressions. (paride)
NOTE: 20260706: Fix Bookworm as well; was this already intended when offering the updates for stable/DSA? (dleidert/front-desk)
--
-vips
+vips/bookworm
NOTE: 20260522: Added by Front-Desk (Beuc)
NOTE: 20260522: Follow bookworm 12.14 (8 CVEs) (Beuc/front-desk)
NOTE: 20260812: Four news CVEs published, already in dsa-needed, sync with
@@ -746,7 +746,7 @@ wireshark
NOTE: 20260430: Added by Front-Desk (lamby)
NOTE: 20260706: Also add for bookworm (Beuc/front-desk)
--
-wordpress
+wordpress/bookworm
NOTE: 20260807: Added by Front-Desk. Follow DSA (rouca)
--
xen/bookworm
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/349a36eaf42af7f237675d86bb32841a2f33a5a8
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/349a36eaf42af7f237675d86bb32841a2f33a5a8
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260901/cd318f69/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list