#47257 - mariadb is vulnerable to CVE-2021-27928 (RCE)

Package	Source(s)		Maintainer(s)
guix		PTS Buildd Popcon

Message #31 received at 47257@debbugs.gnu.org (full text, mbox, reply):

Received: (at 47257) by debbugs.gnu.org; 20 Mar 2021 00:44:14 +0000
From debbugs-submit-bounces@debbugs.gnu.org Fri Mar 19 20:44:14 2021
Received: from localhost ([127.0.0.1]:51222 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1lNPiw-0006Qf-GO
	for submit@debbugs.gnu.org; Fri, 19 Mar 2021 20:44:14 -0400
Received: from world.peace.net ([64.112.178.59]:59422)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <mhw@netris.org>) id 1lNPiu-0006QS-Vi
 for 47257@debbugs.gnu.org; Fri, 19 Mar 2021 20:44:13 -0400
Received: from mhw by world.peace.net with esmtpsa
 (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92)
 (envelope-from <mhw@netris.org>)
 id 1lNPip-0003hv-3D; Fri, 19 Mar 2021 20:44:07 -0400
From: Mark H Weaver <mhw@netris.org>
To: Léo Le Bouter <lle-bout@zaclys.net>
Subject: Re: bug#47257: [PATCH 1/1] gnu: mariadb: Update to 10.5.9 [fixes
 CVE-2021-27928].
In-Reply-To: <87blbemzww.fsf@netris.org>
References: <20210319113537.18290-1-lle-bout@zaclys.net>
 <20210319113537.18290-2-lle-bout@zaclys.net> <87blbemzww.fsf@netris.org>
Date: Fri, 19 Mar 2021 20:42:33 -0400
Message-ID: <878s6imz8r.fsf@netris.org>
MIME-Version: 1.0
Content-Type: text/plain
X-Spam-Score: 0.0 (/)
X-Debbugs-Envelope-To: 47257
Cc: 47257@debbugs.gnu.org
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -1.0 (-)

Mark H Weaver <mhw@netris.org> writes:
> 'package/inherit' is usually the right thing when defining other kinds
> of package variants, however.

One addendum to this guideline: if the package variant you're defining
overrides the 'source' field[*], it's probably pointless to use
'package/inherit', because the fixes embodied in the original package's
replacement would most likely be lost anyway.

[*] One exception is if the overridden 'source' field merely adds some
additional patches to the original package, while taking care to
preserve any existing patches -- that last part is important, even if
the original package doesn't including any patches at the time you look.
In that case, 'package/inherit' might well be helpful.

More generally, when inheriting from another package, it's useful to ask
yourself what should happen if the package you're inheriting from is
later grafted, and to try to arrange for that to happen automatically.

     Thanks,
       Mark

Display info messages

Send a report that this bug log contains spam.

debbugs.gnu.org maintainers <help-debbugs@gnu.org>. Last modified: Sun Dec 22 01:27:28 2024; Machine Name: wallace-server

GNU bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

#47257 mariadb is vulnerable to CVE-2021-27928 (RCE)