Re: SALT

Bastien Roucariès <[email protected]> Sat, 30 Sep 2023 14:08:22 +0000

Newsgroups	gmane.linux.debian.devel.lts,gmane.linux.debian.devel.security
Message-ID	<33490645.2EqoDJRYxZ@portable-bastien>

Le jeudi 28 septembre 2023, 22:46:41 UTC Bastien Roucariès a écrit :
Hi,

An update
> Hi
> 
> I am trying to fix the CVE for SALT

Salt need to be updated due to a failure on the custom crypto protocol what was broken. Both server and client need to be updated due to protocol change.

> 
> Unfortunatly this will need a backport of salt 3002.9 that in turn need:
> python3-saltfactories >= 0.907 (that need python3-setuptools (>= 50.3.2),  python3-setuptools-scm (>= 3.4) to be investigated)
> python3-attr (>= 19.1)
> 
> I believe the first one used only for test could be solved
> 
> For the second one, I think we should not update due to reverse depends
> 
> What is the usual guidance in this case ? Can we embed (python3-venv) the python3-attr package ?
> 
> Is it worthwhile ?

Can I have a piece of advice from security team ?

moreover it seems salt on other distro is EOL or not updated.

Bastien
> 
> Bastien
> 
> [1]
> Package: automat
> Package: black
> Package: cfgrib
> Package: dhcpcanon
> Package: fiona
> Package: magic-wormhole
> Package: magic-wormhole-mailbox-server
> Package: pytest
> Package: python-hypothesis
> Package: python-service-identity
> Package: python-treq
> Package: python-zeep
> Package: rasterio
> Package: ufolib2
>

signature.asc (application/pgp-signature, 833 B)