Debian Bug report logs - #691900
gwt: CVE-2012-4563

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: gwt: CVE-2012-4563

Date: Wed, 31 Oct 2012 07:47:07 +0100

Package: gwt
Severity: grave
Tags: security
Justification: user security hole

Please see https://developers.google.com/web-toolkit/release-notes#Release_Notes_2_4_0
under "Security vulnerability in GWT 2.4".

This was assigned CVE-2012-4563

Cheers,
        Moritz

Message #10 received at 691900@bugs.debian.org (full text, mbox, reply):

From: Charles Plessy <plessy@debian.org>

To: 691900@bugs.debian.org

Subject: Re: [pkg-eucalyptus-maintainers] Bug#691900: gwt: CVE-2012-4563

Date: Thu, 1 Nov 2012 14:38:02 +0900

Le Wed, Oct 31, 2012 at 07:47:07AM +0100, Moritz Muehlenhoff a écrit :
> Package: gwt
> Severity: grave
> Tags: security
> Justification: user security hole
> 
> Please see https://developers.google.com/web-toolkit/release-notes#Release_Notes_2_4_0
> under "Security vulnerability in GWT 2.4".

Hi all,

is there a volunteer to step in ?  Otherwise, can I try to solve that bug
by upgrading to 2.5.0 ?

Cheers,

-- 
Charles

Message #15 received at 691900@bugs.debian.org (full text, mbox, reply):

From: Charles Plessy <plessy@debian.org>

To: 684453@bugs.debian.org, Thomas Koch <thomas@koch.ro>

Cc: 691900@bugs.debian.org, debian-java@lists.debian.org

Subject: Re: [pkg-eucalyptus-maintainers] Bug#691900: gwt: CVE-2012-4563

Date: Fri, 2 Nov 2012 10:05:37 +0900

Le Wed, Oct 31, 2012 at 07:47:07AM +0100, Moritz Muehlenhoff a écrit :
> Package: gwt
> Severity: grave
> Tags: security
> Justification: user security hole
> 
> Please see https://developers.google.com/web-toolkit/release-notes#Release_Notes_2_4_0
> under "Security vulnerability in GWT 2.4".
> 
> This was assigned CVE-2012-4563

Dear Thomas and Java team

In http://bugs.debian.org/684453, you have suggested to transfer the gwt
package under the debian-java umbrella.  We agreed, and action was delayed by a
technical problem on the Dpkg side.

It is a bit embarassing to ping you with a grave bug, but if you would like to
take over the package, this is the good moment...

In particular I do not know if the best resolution for this bug is to upgrade
to 2.5.0 or to patch, so I am reluctant to take action by myself, worrying that
I might complicate your work on Gerrit.

Please let me know if I can help,

-- 
Charles Plessy
Tsurumi, Kanagawa, Japan

Message #20 received at 691900@bugs.debian.org (full text, mbox, reply):

From: Thomas Koch <thomas@koch.ro>

To: Charles Plessy <plessy@debian.org>

Cc: 684453@bugs.debian.org, 691900@bugs.debian.org, debian-java@lists.debian.org

Subject: Re: [pkg-eucalyptus-maintainers] Bug#691900: gwt: CVE-2012-4563

Date: Fri, 2 Nov 2012 07:43:19 +0100

Charles Plessy:
> Dear Thomas and Java team
> 
> In http://bugs.debian.org/684453, you have suggested to transfer the gwt
> package under the debian-java umbrella.  We agreed, and action was delayed
> by a technical problem on the Dpkg side.
> 
> It is a bit embarassing to ping you with a grave bug, but if you would like
> to take over the package, this is the good moment...
> 
> In particular I do not know if the best resolution for this bug is to
> upgrade to 2.5.0 or to patch, so I am reluctant to take action by myself,
> worrying that I might complicate your work on Gerrit.

Hi Charles,

thank you for pinging me. I've just spend three days on Debian work. Could you 
deal with it by updating to 2.5.0 and also set the maintainer to the java 
packaging team?

There's also a Git repo at 
http://anonscm.debian.org/gitweb/?p=pkg-java/gwt.git
The branch thkoch_patches contains commits to publish the maven artifacts.

I've also filled a bug at Gerrit and asked them to update to gwt 2.5

Regards,

Thomas Koch, http://www.koch.ro

Message #25 received at 691900@bugs.debian.org (full text, mbox, reply):

From: Charles Plessy <plessy@debian.org>

To: Thomas Koch <thomas@koch.ro>

Cc: Charles Plessy <plessy@debian.org>, 691900@bugs.debian.org, debian-java@lists.debian.org

Subject: Re: [pkg-eucalyptus-maintainers] Bug#691900: gwt: CVE-2012-4563

Date: Sat, 3 Nov 2012 22:23:18 +0900

Le Fri, Nov 02, 2012 at 07:43:19AM +0100, Thomas Koch a écrit :
> Charles Plessy:
> > 
> > In particular I do not know if the best resolution for this bug is to
> > upgrade to 2.5.0 or to patch, so I am reluctant to take action by myself,
> > worrying that I might complicate your work on Gerrit.
> 
> Hi Charles,
> 
> thank you for pinging me. I've just spend three days on Debian work. Could you 
> deal with it by updating to 2.5.0 and also set the maintainer to the java 
> packaging team?

Hi Thomas,

I have updated the source package to 2.5.0 (checked copyrights, refreshed the
patches), but unfortunately it does not build.  I suppose that some ground work
is needed on the Java side, but I am not able to do it.

I committed all my changes to the Git repository.

Cheers,

-- 
Charles

Message #30 received at 691900@bugs.debian.org (full text, mbox, reply):

From: Moritz Muehlenhoff <jmm@inutil.org>

To: Charles Plessy <plessy@debian.org>

Cc: Thomas Koch <thomas@koch.ro>, 691900@bugs.debian.org, debian-java@lists.debian.org

Subject: Re: [pkg-eucalyptus-maintainers] Bug#691900: gwt: CVE-2012-4563

Date: Wed, 21 Nov 2012 10:11:41 +0100

On Sat, Nov 03, 2012 at 10:23:18PM +0900, Charles Plessy wrote:
> Le Fri, Nov 02, 2012 at 07:43:19AM +0100, Thomas Koch a écrit :
> > Charles Plessy:
> > > 
> > > In particular I do not know if the best resolution for this bug is to
> > > upgrade to 2.5.0 or to patch, so I am reluctant to take action by myself,
> > > worrying that I might complicate your work on Gerrit.
> > 
> > Hi Charles,
> > 
> > thank you for pinging me. I've just spend three days on Debian work. Could you 
> > deal with it by updating to 2.5.0 and also set the maintainer to the java 
> > packaging team?
> 
> Hi Thomas,
> 
> I have updated the source package to 2.5.0 (checked copyrights, refreshed the
> patches), but unfortunately it does not build.  I suppose that some ground work
> is needed on the Java side, but I am not able to do it.
> 
> I committed all my changes to the Git repository.

Please note that the initial fix was incomplete, CVE-2012-5920 was assigned for
that: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5920

Cheers,
        Moritz

Message #35 received at 691900-done@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 681923-done@bugs.debian.org,684453-done@bugs.debian.org,685587-done@bugs.debian.org,691900-done@bugs.debian.org,692565-done@bugs.debian.org,697193-done@bugs.debian.org,713162-done@bugs.debian.org,

Cc: gwt@packages.debian.org, gwt@packages.qa.debian.org

Subject: Bug#718911: Removed package(s) from unstable

Date: Fri, 09 Aug 2013 06:53:33 +0000

Version: 2.4.0-1+rm

Dear submitter,

as the package gwt has just been removed from the Debian archive
unstable we hereby close the associated bug reports.  We are sorry
that we couldn't deal with your issue properly.

For details on the removal, please see http://bugs.debian.org/718911

The version of this package that was in Debian prior to this removal
can still be found using http://snapshot.debian.org/.

This message was generated automatically; if you believe that there is
a problem with it please contact the archive administrators by mailing
ftpmaster@ftp-master.debian.org.

Debian distribution maintenance software
pp.
Ansgar Burchardt (the ftpmaster behind the curtain)

Send a report that this bug log contains spam.