[Pkg-salt-team] salt buster 10x CVE 2021 upstream patches backported

[Federico Grau]

Replying without patches, so the messages gets to the ML.

On Sat, Apr 24, 2021 at 02:19:12PM -0400, Federico Grau wrote:
> Hello all -
> 
> As part of the Salzburg BSP, we've been progressing some of the security
> issues with Salt.   Attached is my draft .dsc integrating upstream backported
> patches into the buster Salt packages.  In this version, only 2x
> debian/patches (Fix-CVE-2021*) were added along with series and a d/changelog
> entry.
> 
> I'm new to sending these sort of diffs, let me know if additional or alternate
> files are needed.
> 
> # salt upstream patches source
> https://gitlab.com/saltstack/open/salt-patches
> 
> #debian-bsp-2021-szg
> https://lists.debian.org/debian-devel-announce/2021/04/msg00010.html


> Format: 3.0 (quilt)
> Source: salt
> Binary: salt-common, salt-master, salt-minion, salt-syndic, salt-ssh, salt-doc, salt-cloud, salt-api, salt-proxy
> Architecture: all
> Version: 2018.3.4+dfsg1-6+deb10u2.1
> Maintainer: Debian Salt Team <pkg-salt-team at lists.alioth.debian.org>
> Uploaders: Joe Healy <joehealy at gmail.com>, Franklin G Mendoza <franklin.g.mendoza at gmail.com>, Andriy Senkovych <jolly_roger at itblog.org.ua>, Benjamin Drung <benjamin.drung at cloud.ionos.com>, Ondřej Nový <onovy at debian.org>
> Homepage: http://saltstack.org/
> Standards-Version: 4.3.0
> Vcs-Browser: https://salsa.debian.org/salt-team/salt
> Vcs-Git: https://salsa.debian.org/salt-team/salt.git
> Testsuite: autopkgtest
> Testsuite-Triggers: python3, python3-augeas, python3-boto, python3-boto3, python3-cherrypy3, python3-consul, python3-croniter, python3-crypto, python3-dnspython, python3-docker, python3-elasticsearch, python3-etcd, python3-hglib, python3-isodate, python3-jsonschema, python3-junos-eznc, python3-keyring, python3-kubernetes, python3-ldap, python3-libcloud, python3-mock, python3-mysqldb, python3-pip, python3-pygit2, python3-pyinotify, python3-pyroute2, python3-pytestsalt, python3-pytoml, python3-pyvmomi, python3-twilio, python3-zmq, virtualenv
> Build-Depends: bash-completion, debhelper (>= 11), dh-python, dpkg-dev (>= 1.16.2), python3, python3 (>= 3.6) | python3-mock, python3-augeas, python3-boto, python3-boto3, python3-cherrypy3, python3-consul, python3-croniter, python3-crypto (>= 2.6), python3-dateutil, python3-dnspython, python3-docker, python3-elasticsearch, python3-etcd, python3-git, python3-hglib, python3-isodate, python3-jinja2, python3-jsonschema, python3-junos-eznc, python3-keyring, python3-kubernetes, python3-ldap, python3-libcloud (>= 0.14.1), python3-msgpack, python3-mysqldb, python3-pip, python3-psutil, python3-pygit2, python3-pyinotify, python3-pyroute2, python3-pytestsalt, python3-pytoml, python3-pyvmomi, python3-requests (>= 1.0.0), python3-setuptools, python3-tornado4 (>= 4.2) | python3-tornado (<< 5), python3-tornado4 (>= 4.2) | python3-tornado (>= 4.2), python3-twilio, python3-yaml, python3-zmq (>= 13.1.0), virtualenv
> Build-Depends-Indep: python3-doc, python3-sphinx (>= 1.3.5)
> Package-List:
>  salt-api deb admin optional arch=all
>  salt-cloud deb admin optional arch=all
>  salt-common deb admin optional arch=all
>  salt-doc deb doc optional arch=all
>  salt-master deb admin optional arch=all
>  salt-minion deb admin optional arch=all
>  salt-proxy deb admin optional arch=all
>  salt-ssh deb admin optional arch=all
>  salt-syndic deb admin optional arch=all
> Checksums-Sha1:
>  8293356cdcdb4db5777c28dda673e2620ae23520 9087128 salt_2018.3.4+dfsg1.orig.tar.xz
>  7f70b9f5c81449016f496df2fb8810d440f7edb5 87944 salt_2018.3.4+dfsg1-6+deb10u2.1.debian.tar.xz
> Checksums-Sha256:
>  c1793b5eeb98fbb8e0698b59d5f3a55d2684da17a053d3f498ec84d1e81edd2a 9087128 salt_2018.3.4+dfsg1.orig.tar.xz
>  a93720ee2d6124e91a61f9488417547316014dac2b4180bad8248c3c9b5c064b 87944 salt_2018.3.4+dfsg1-6+deb10u2.1.debian.tar.xz
> Files:
>  1b07796d2b1af27ca51aa31efdfe6a69 9087128 salt_2018.3.4+dfsg1.orig.tar.xz
>  7b5957bf9d3ac71eddfade9b98c2d21e 87944 salt_2018.3.4+dfsg1-6+deb10u2.1.debian.tar.xz

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-salt-team/attachments/20210424/7bf311e8/attachment.sig>