CVE-2020-8903 CVE-2020-8907 CVE-2020-8933

Debian Bug report logs - #987353
CVE-2020-8903 CVE-2020-8907 CVE-2020-8933

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2020-8903 CVE-2020-8907 CVE-2020-8933

Date: Thu, 22 Apr 2021 10:45:09 +0200

Source: google-compute-image-packages
Severity: grave
Tags: security
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>

https://cloud.google.com/compute/docs/security-bulletins#2020619 seems unfixed
unstable/bullseye still.

Patches:	
https://github.com/GoogleCloudPlatform/guest-oslogin/pull/29

Cheers,
        Moritz	
	

Message #10 received at 987353@bugs.debian.org (full text, mbox, reply):

From: Zach Marano <zmarano@google.com>

To: 987353@bugs.debian.org

Subject: Re: Bug#987353: CVE-2020-8903 CVE-2020-8907 CVE-2020-8933

Date: Thu, 22 Apr 2021 09:53:24 -0700

[Message part 1 (text/plain, inline)]

Hi, since this package was brought into Debian in ~2018, there have been
several transformations in the GCE guest software stack and thus the
current landscape is very different. Google doesn't actually maintain the
official Debian package and we're not sure who is, if anyone. The Google
provided packages are shipped separately and will override the Debian
package if you use them from our repositories. Please see either our Google
Cloud docs <https://cloud.google.com/compute/docs/images/guest-environment>
or github readme
<https://github.com/GoogleCloudPlatform/compute-image-packages> for info on
the packages we are maintaining and shipping for Debian systems and on the
base Google provided GCE Debian images. Unfortunately, we never did find a
DD sponsor to help maintain our guest packages in Debian on the cadence
that we needed. I would advocate for removing this package from Debian if
we can't find a set of maintainers.

-----
Zach Marano
zmarano@google.com


On Thu, Apr 22, 2021 at 1:48 AM Moritz Muehlenhoff <jmm@debian.org> wrote:

> Source: google-compute-image-packages
> Severity: grave
> Tags: security
> X-Debbugs-Cc: Debian Security Team <team@security.debian.org>
>
> https://cloud.google.com/compute/docs/security-bulletins#2020619 seems
> unfixed
> unstable/bullseye still.
>
> Patches:
> https://github.com/GoogleCloudPlatform/guest-oslogin/pull/29
>
> Cheers,
>         Moritz
>
>
>

[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.