An LTS security update is needed for the following source packages.
When you add a new entry, please keep the list alphabetically sorted.

The specific CVE IDs do not need to be listed, they can be gathered in an up-to-date manner from
https://security-tracker.debian.org/tracker/source-package/SOURCEPACKAGE
when working on an update.

To pick an issue, simply add your name behind it. To learn more about how
this list is updated have a look at
https://wiki.debian.org/LTS/Development#Triage_new_security_issues

To make it easier to see the entire history of an update, please append notes
rather than remove/replace existing ones.

--
amd64-microcode
  NOTE: 20210831: no binary package was built, possibly due to non-free-specific rules
  NOTE: 20210831: https://lists.debian.org/debian-lts/2021/08/msg00033.html
  NOTE: 20210831: needs to be fixed (Beuc)
--
ansible (Lee Garrett)
  NOTE: 20210411: As discussed with the maintainer I will update Buster first and
  NOTE: 20210411: after that LTS. (apo)
  NOTE: 20210426: https://people.debian.org/~apo/lts/ansible/
--
cacti (Roberto C. Sánchez)
  NOTE: 20210829: not really sure whether affected, please recheck
  NOTE: 20210914: still assessing whether or not affected (roberto)
--
debian-archive-keyring (Utkarsh)
  NOTE: https://lists.debian.org/debian-lts/2021/08/msg00037.html
  NOTE: 20210920: Raphael answered. will backport today. (utkarsh)
  NOTE: 20211003: waiting for Jonathan to get back as his keys
  NOTE: 20211003: seemed to have expired and the build is thus
  NOTE: 20211003: failing. Or at least appears to be. :( (utkarsh)
--
exiv2 (Thorsten Alteholz)
--
faad2 (Thorsten Alteholz)
--
ffmpeg (Anton Gladky)
  NOTE: probably wait until stuff is fixed in Buster
--
firmware-nonfree
  NOTE: 20210731: WIP: https://salsa.debian.org/lts-team/packages/firmware-nonfree
  NOTE: 20210828: Most CVEs are difficult to backport. Contacted Ben regarding possible "ignore" tag
--
jsoup (Markus Koschany)
--
linux (Ben Hutchings)
--
linux-4.19 (Ben Hutchings)
--
mediawiki (Markus Koschany)
--
mosquitto
  NOTE: 20210805: coordinating upload to buster before DLA for Stretch (codehelp)
  NOTE: 20210806: CVE-2021-34432 ignored in buster and stretch. Vulnerable code not accessible. (codehelp)
--
nghttp2 (Anton Gladky)
--
ntfs-3g (Abhijith PA)
--
nvidia-graphics-drivers
  NOTE: package is in non-free but also in packages-to-support
  NOTE: only CVE‑2021‑1076 seems to be fixed in the R390 branch used in Stretch, no fix available for CVE-2021-1077
--
openssh (Utkarsh)
  NOTE: 20211003: a backporting error for CVE-2018-15473 was reported in
  NOTE: 20211003: Ubuntu (and can see the same code differences here);
  NOTE: 20211003: check if that needs to be fixed; talking to -security.
  NOTE: 20211003: also CVE-2021-41617 is new; might be a good idea to
  NOTE: 20211003: club both these together. (utkarsh)
--
python3.5 (Utkarsh)
  NOTE: 20211003: whilst looks like a no-dsa/postponed candidate on a
  NOTE: 20211003: quick look, Canonical issued an update via the ESM
  NOTE: 20211003: pocket. Needs another look. (utkarsh)
--
python-babel
  NOTE: 20210617: CVE-2021-20095 withdrawn, cf. 251b6e33 and #987824 (abhijith)
  NOTE: 20210620: http://people.debian.org/~abhijith/backport_of_3a700b5.patch (abhijith)
  NOTE: 20210620: Revisit when it has an assigned CVE ID (abhijith)
--
ruby2.3
  NOTE: 20210802: Utkarsh already uploaded a fix for sid/bullseye. (utkarsh)
  NOTE: 20210816: wip, backporting patches; a bit hard. (utkarsh)
  NOTE: 20210920: in midst of backporting patches. (utkarsh)
  NOTE: 20211003: only backporting CVE-2021-31810 is left, which has a bit
  NOTE: 20211003: of difference whilst going back to ruby2.3. (utkarsh)
--
rustc
  NOTE: rust-doc in stretch-lts (and jessie-lts) is not installable
  NOTE: https://bugs.debian.org/928422
  NOTE: Perhaps fix with the next rustc update for a new Firefox? (bunk)
--
salt
  NOTE: 20210329: WIP (utkarsh)
  NOTE: 20210510: patches ready; reviewing and testing with donfede, damien, and bdrung. (utkarsh)
  NOTE: 20210510: will try to release ASAP; also preparing update for buster (DSA). (utkarsh)
  NOTE: 20210607: new CVE patch proposed by damien; donfede to provide a debdiff. (utkarsh)
  NOTE: 20210816: will test the provided debdiff; needs testing as regression spotted. (utkarsh)
--
smarty3
  NOTE: 20210829: Track regression (abhijith)
  NOTE: 20210906: prepared a build for testing. Waiting for bug submitter's reply (abhijith)
--
squashfs-tools (Thorsten Alteholz)
  NOTE: 20210926: coordinate with upload to other releases
--