Processed: bookworm-pu: package util-linux/2.38.1-5+deb12u3

[Debian Bug Tracking System]

affects -1 + src:util-linux

Bug #1088008 [release.debian.org] bookworm-pu: package util-linux/2.38.1-5+deb12u3
Added indication that 1088008 affects src:util-linux

[Jonathan Wiltshire]

Control: tag -1 d-i

[ Reason ]
In the mitigation for CVE-2024-28085 util-linux intended to disable
setgid on write and wall. I used --disable-tty-group to achieve this.
However this causes `mesg y` to behave differently, it sets the tty mode
a+w.
This is surprising and not what was intended. Upstream removed this
misfeature and added a new configure flag to stop installing write, wall
setgid.
This update adds the upstream patch(es) and uses the new configure flag
instead.

d-i ack needed for the udebs, in CC.

Thanks,

[Debian Bug Tracking System]

Post by Jonathan Wiltshire
tag -1 d-i

Bug #1088008 [release.debian.org] bookworm-pu: package util-linux/2.38.1-5+deb12u3
Added tag(s) d-i.

[Cyril Brulebois]

Post by Jonathan Wiltshire
Control: tag -1 d-i

[ Reason ]
In the mitigation for CVE-2024-28085 util-linux intended to disable
setgid on write and wall. I used --disable-tty-group to achieve this.
However this causes `mesg y` to behave differently, it sets the tty mode
a+w.
This is surprising and not what was intended. Upstream removed this
misfeature and added a new configure flag to stop installing write, wall
setgid.
This update adds the upstream patch(es) and uses the new configure flag
instead.

d-i ack needed for the udebs, in CC.

No objections, thanks.


Cheers,

[Jonathan Wiltshire]

Control: tag -1 confirmed

Please go ahead.

Thanks,

[Debian Bug Tracking System]

Post by Jonathan Wiltshire
tag -1 confirmed

Bug #1088008 [release.debian.org] bookworm-pu: package util-linux/2.38.1-5+deb12u3
Added tag(s) confirmed.

[Jonathan Wiltshire]

package release.debian.org
tags 1088008 = bookworm pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian bookworm.

Thanks for your contribution!

Upload details
==============

Package: util-linux
Version: 2.38.1-5+deb12u3

Explanation: fix wider mitigation for CVE-2024-28085

[Debian Bug Tracking System]

Post by Jonathan Wiltshire
package release.debian.org

Limiting to bugs with field 'package' containing at least one of 'release.debian.org'
Limit currently set to 'package':'release.debian.org'

Post by Jonathan Wiltshire
tags 1088008 = bookworm pending

Bug #1088008 [release.debian.org] bookworm-pu: package util-linux/2.38.1-5+deb12u3
Added tag(s) pending; removed tag(s) d-i and confirmed.

Post by Jonathan Wiltshire
thanks

Stopping processing here.

Please contact me if you need assistance.

[Debian Bug Tracking System]

Your message dated Sat, 11 Jan 2025 11:03:09 +0000
with message-id <E1tWZGn-009jcW-***@coccia.debian.org>
and subject line Close 1088008
has caused the Debian Bug report #1088008,
regarding bookworm-pu: package util-linux/2.38.1-5+deb12u3
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ***@bugs.debian.org
immediately.)