Here is my transparent report for my work on the Debian Long Term Support (LTS) and Debian Extended Long Term Support (ELTS), which extend the security support for past Debian releases, as a paid contributor.
In September, the monthly sponsored hours were split evenly among contributors depending on their max availability - I was assigned 23.75h for LTS (out of 30 max) and 20h for ELTS (max).
I was again able to factor out some time between LTS and ELTS.
The qemu update required more testing than I expected, as it's used with lots of different CPU and disk backends.
ELTS - Wheezy
- CVE-2019-13626/libsdl1.2: triage: mark postponed so it doesn't stay in the triage list
- freetype: CVE-2015-9381,CVE-2015-9382,CVE-2015-9383 security upload
- freetype: de-dup TEMP-0773084-4AB1FB / CVE-2014-9659
- CVE-2019-13232/unzip: regression update (zipbomb)
- CVE-2019-5481/curl: triage: not-affected
- CVE-2019-1549/openssl: triage: not-affected
- CVE-2019-16163/libonig: security upload
- CVE-2019-2180/cups: triage: was fixed prior CVE assignment, no other significant vulnerability to fix, no upload
- tomcat7: investigate upgrading to upstream stable version, so as to fix the currently failing testsuite; decide not to when realizing that means applying all upstream changes since 2012
- CVE-2019-3689/nfs-utils: triage, contact package maintainer
- CVE-2019-16935/python*: help Ola triage and assess severity
LTS - Jessie
- freetype: CVE-2015-9381,CVE-2015-9382,CVE-2015-9383 security upload
- radare2: triage: clarify status, add reference to ML discussion about its support
- unzip: untriage: false-positive
- CVE-2019-16163/libonig: security upload
- qemu:
- check status of unpublished prepared update for CVE-2016-5126,CVE-2016-5403,CVE-2017-9375,CVE-2017-15124,CVE-2019-12155
- CVE-2017-11334: triage: clarify, keep postponed (known regression)
- CVE-2017-13672: triage: ignored: minor issue, guest root DoS, too complex to backport
- CVE-2017-15124: re-triage: ignored: identify regression in proposed update, too complex to backport; reference complementary VNC/SASL patch
- CVE-2018-19665: triage: ignored: still no sanctioned patch, bluetooth subsystem deprecated
- CVE-2018-15746: triage: ignored: non-default configuration, requires backported kernel and libseccomp
- CVE-2019-12067: triage: postponed: no sanctioned patch
- setup physical jessie box, test extensively (Xen, KVM, virt-manager/gnome-boxes, VNC, Spice, Windows, LVM, VirtIO, iSCSI...)
- call for testing
- security upload: pending update -CVE-2017-15124 +CVE-2019-12068,CVE-2019-13164,CVE-2019-14378,CVE-2019-15890
Documentation/Scripts