Bug#1079847: Should jodd be removed from unstable?

[Helmut Grohne]

Source: jodd
Severity: serious
Justification: grab attention of maintainer
User: helmutg at debian.org
Usertags: sidremove

Dear maintainer,

I suggest removing jodd from Debian for the following reasons:
 * It accumulated one RC-bug:
   + #961298: jodd: CVE-2018-21234: Potential vulnerability in JSON deserialization
     Last modified: 3 years

 * It is not part of bookworm or trixie and is not a key package.

This bug serves as a pre-removal warning. After one month, the bug will be
reassigned to ftp.debian.org to actually request removal of the package.

In case the package should be kept in unstable, please evaluate each of the
RC-bugs listed above.
 * If the bug is meant to prevent the package from entering testing or a stable
   release, but this package should stay part of unstable, please add a
   usertag:

       user helmutg at debian.org
       usertags NNN + sidremove-ignore

 * If the bug no longer applies, please close it. If it is closed, check
   whether the fixed version is correct and adjust if necessary.

 * Is the bug really release-critical? If not, please downgrade.

 * If the bug still applies, please send a status update at least once a year.

Once all of the mentioned RC bugs have been acted upon in one way or another,
please close this bug.

In case the package should be removed from unstable, you may reassign this
bug report:

    Control: severity -1 normal
    Control: retitle -1 RM: jodd -- RoM; rc-buggy
    Control: reassign -1 ftp.debian.org

Alternatively, you may wait a month and have it reassigned.

In case you disagree with the above, please downgrade this bug below RC
severity. Doing so will also prevent automatic reassignment.

Kind regards

A tool for automatically removing packages from unstable

This bug report has been automatically filed with little human intervention.
If the filing is unclear or in error, don't hesitate to contact
Helmut Grohne <helmut at subdivi.de> for assistance.