[Pkg-roundcube-maintainers] Bug#1146838: AW: Bug#1146838: planned updates for bookworm and trixie?

[Björn Wiggert (wiggert.it)]

Hi Guilhem,

thanks for the clarification.


Just to make sure I understand the current situation correctly:

Does this mean that all Roundcube installations using the currently available Debian 12 and Debian 13 packages are currently vulnerable to at least some of the issues fixed in Roundcube 1.6.19?


And is my understanding correct that the updates for bookworm and trixie have effectively been held back while waiting for CVE IDs to be assigned?

I am asking because this would mean that known security issues remain unfixed in the supported Debian packages for the time being, even though upstream fixes are already available.


Is waiting for CVE assignment before publishing such updates normal Debian security practice in this situation, or is this an exceptional case?


Best regards
Björn


________________________________
Von: Guilhem Moulin <guilhem at debian.org>
Gesendet: Dienstag, 29. September 2026 14:43
An: Björn Wiggert (wiggert.it); 1146838 at bugs.debian.org
Betreff: Re: Bug#1146838: planned updates for bookworm and trixie?

Hi,

On Tue, 29 Sep 2026 at 11:53:51 +0000, Björn Wiggert (wiggert.it) wrote:
> Are updates planned for the supported stable releases as well?
>
> In particular:
>
>  *   Is a security/LTS update such as 1.6.5+dfsg-1+deb12u12 planned for bookworm?
>  *   Is an update for trixie planned, e.g. via trixie-security or a point update?

Yes.

>  *   If so, is there already an approximate plan or package being prepared?

I was waiting for the CVE IDs to be assigned, but given it didn't happen
yet 3 weeks after the assignment request it might be worth issuing the
updates without CVE IDs.

--
Guilhem.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-roundcube-maintainers/attachments/20260929/8a5ef759/attachment.htm>