[Pkg-roundcube-maintainers] Bug#1146838: AW: Bug#1146838: planned updates for bookworm and trixie?

[Björn Wiggert (wiggert.it)]

Hi Guilhem,

thanks, that makes sense.


Given that the affected Debian 12 and Debian 13 packages are currently exposed to known issues, would there be any chance to get the fix published out of the normal CVE timing, i.e. before CVE IDs are assigned?


Even a targeted security update with the already available upstream fixes would help reduce the exposure for production Roundcube installations.


Björn



________________________________
Von: Guilhem Moulin <guilhem at debian.org>
Gesendet: Dienstag, 29. September 2026 16:06
An: Björn Wiggert (wiggert.it)
Cc: 1146838 at bugs.debian.org
Betreff: Re: Bug#1146838: planned updates for bookworm and trixie?

On Tue, 29 Sep 2026 at 13:24:48 +0000, Björn Wiggert (wiggert.it) wrote:
> Does this mean that all Roundcube installations using the currently
> available Debian 12 and Debian 13 packages are currently vulnerable to
> at least some of the issues fixed in Roundcube 1.6.19?

Yes.

> And is my understanding correct that the updates for bookworm and
> trixie have effectively been held back while waiting for CVE IDs to be
> assigned?

Yes.

> I am asking because this would mean that known security issues remain
> unfixed in the supported Debian packages for the time being, even
> though upstream fixes are already available.
>
> Is waiting for CVE assignment before publishing such updates normal
> Debian security practice in this situation, or is this an exceptional
> case?

Ideally each upstream project would have an embargoed process with its
downstreams and request CVE IDs themselves (in coordinations with the
reporters).  This is not the case here.
https://github.com/roundcube/roundcubemail/issues/10123

--
Guilhem.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-roundcube-maintainers/attachments/20260929/aff9b1f5/attachment-0001.htm>