data/dsa-needed.txt


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

A DSA is needed for the following source packages in old/stable. The specific
CVE IDs do not need to be listed, they can be gathered in an up-to-date manner from
https://security-tracker.debian.org/tracker/source-package/SOURCEPACKAGE
when working on an update.

Some packages are not tracked here:
- Linux kernel (tracking in kernel-sec repo)
- Embargoed issues continue to be tracked in separate file.

To pick an issue, simply add your uid behind it.

If needed, specify the release by adding a slash after the name of the source package.

--
atril (jmm)
--
chromium (dilinger)
--
dav1d (jmm)
--
dnsdist (jmm)
--
dnsmasq
--
emacs
--
expat (carnil)
--
frr
--
gpac/oldstable
--
h2o (jmm)
--
less (carnil)
--
libreswan (jmm)
  Maintainer prepared bookworm-security update, but needs work on bullseye-security backports
--
linux (carnil)
  Wait until more issues have piled up, though try to regulary rebase for point
  releases to more recent v5.10.y and 6.1.y versions
--
nbconvert/oldstable
  Guilhem Moulin proposed an update ready for review
--
nodejs
--
opennds/stable
--
org-mode
--
pdns-recursor (jmm)
--
php-cas/oldstable
--
php-horde-mime-viewer/oldstable
--
php-horde-turba/oldstable
--
phppgadmin
--
pillow (jmm)
--
pymatgen/stable
--
python-asyncssh
--
redmine/stable
--
ring/oldstable
  might make sense to rebase to current version
--
ruby2.7/oldstable
  Utkarsh Gupta offered help in preparing updates
--
ruby3.1/stable
--
ruby-nokogiri/oldstable
--
ruby-rack
--
ruby-rails-html-sanitizer
--
ruby-sinatra/oldstable
  Maintainer posted packaging repository link with proposed changes for review
--
ruby-tzinfo/oldstable
--
salt/oldstable
--
squid
--
webkit2gtk (berto)
--
wpa
--
zabbix
--