
Like each month, have a look at the work funded by Freexian’s Debian LTS offering.
Debian LTS contributors
In February, 18 contributors have been paid to work on Debian LTS, their reports are available:
- Abhijith PA did 10.0h (out of 8.0h assigned and 6.0h from previous period), thus carrying over 4.0h to the next month.
- Adrian Bunk did 12.0h (out of 0.0h assigned and 63.5h from previous period), thus carrying over 51.5h to the next month.
- Andrej Shadura did 10.0h (out of 6.0h assigned and 4.0h from previous period).
- Bastien Roucariès did 20.0h (out of 20.0h assigned).
- Ben Hutchings did 12.0h (out of 8.0h assigned and 16.0h from previous period), thus carrying over 12.0h to the next month.
- Chris Lamb did 18.0h (out of 18.0h assigned).
- Daniel Leidert did 23.0h (out of 20.0h assigned and 6.0h from previous period), thus carrying over 3.0h to the next month.
- Emilio Pozuelo Monfort did 53.0h (out of 53.0h assigned and 0.75h from previous period), thus carrying over 0.75h to the next month.
- Guilhem Moulin did 11.0h (out of 3.25h assigned and 16.75h from previous period), thus carrying over 9.0h to the next month.
- Jochen Sprickerhof did 27.0h (out of 30.0h assigned), thus carrying over 3.0h to the next month.
- Lee Garrett did 11.75h (out of 9.5h assigned and 44.25h from previous period), thus carrying over 42.0h to the next month.
- Markus Koschany did 40.0h (out of 40.0h assigned).
- Roberto C. Sánchez did 7.0h (out of 14.75h assigned and 9.25h from previous period), thus carrying over 17.0h to the next month.
- Santiago Ruano Rincón did 19.75h (out of 21.75h assigned and 3.25h from previous period), thus carrying over 5.25h to the next month.
- Sean Whitton did 6.0h (out of 6.0h assigned).
- Sylvain Beucler did 52.5h (out of 14.75h assigned and 39.0h from previous period), thus carrying over 1.25h to the next month.
- Thorsten Alteholz did 11.0h (out of 11.0h assigned).
- Tobias Frost did 17.0h (out of 17.0h assigned).
Evolution of the situation
In February, we have released 38 DLAs.
- Notable security updates:
- pam-u2f, prepared by Patrick Winnertz, fixed an authentication bypass vulnerability
- openjdk-17, prepared by Emilio Pozuelo Monfort, fixed an authorization bypass/information disclosure vulnerability
- firefox-esr, prepared by Emilio Pozuelo Monfort, fixed several vulnerabilities
- thunderbird, prepared by Emilio Pozuelo Monfort, fixed several vulnerabilities
- postgresql-13, prepared by Christoph Berg, fixed an SQL injection vulnerability
- freerdp2, prepared by Tobias Frost, fixed several vulnerabilities
- openssh, prepared by Colin Watson, fixed a machine-in-the-middle vulnerability
LTS contributors Emilio Pozuelo Monfort and Santiago Ruano Rincón coordinated the administrative aspects of LTS updates of postgresql-13 and pam-u2f, which were prepared by the respective maintainers, to whom we are most grateful.
As has become the custom of the LTS team, work is under way on a number of package updates targeting Debian 12 (codename “bookworm”) with fixes for a variety of vulnerabilities. In February, Guilhem Moulin prepared an upload of sssd, while several other updates are still in progress. Bastien Roucariès prepared an upload of krb5 for unstable as well.
Given the importance of the Debian Security Tracker to the work of the LTS Team, we regularly contribute improvements to it. LTS contributor Emilio Pozuelo Monfort reviewed and merged a change to improve performance, and then dealt with unexpected issues that arose as a result. He also made improvements in the processing of CVEs which are not applicable to Debian.
Looking to the future (the release of Debian 13, codename “trixie”, and beyond), LTS contributor Santiago Ruano Rincón has initiated a conversation among the broader community involved in the development of Debian. The purpose of the discussion is to explore ways to improve the long term supportability of packages in Debian, specifically by focusing effort on ensuring that each Debian release contains the “best” supported upstream version of packages with a history of security issues.
Thanks to our sponsors
Sponsors that joined recently are in bold.
- Platinum sponsors:
- Toshiba Corporation (for 113 months)
- Civil Infrastructure Platform (CIP) (for 81 months)
- VyOS Inc (for 46 months)
- Gold sponsors:
- Roche Diagnostics International AG (for 124 months)
- Akamai - Linode (for 118 months)
- Babiel GmbH (for 107 months)
- Plat’Home (for 107 months)
- University of Oxford (for 64 months)
- Deveryware (for 51 months)
- EDF SA (for 35 months)
- Dataport AöR (for 11 months)
- CERN (for 8 months)
- Silver sponsors:
- Domeneshop AS (for 128 months)
- Nantes Métropole (for 122 months)
- Univention GmbH (for 114 months)
- Université Jean Monnet de St Etienne (for 114 months)
- Ribbon Communications, Inc. (for 108 months)
- Exonet B.V. (for 98 months)
- Leibniz Rechenzentrum (for 92 months)
- Ministère de l’Europe et des Affaires Étrangères (for 76 months)
- Cloudways by DigitalOcean (for 65 months)
- Dinahosting SL (for 63 months)
- Bauer Xcel Media Deutschland KG (for 58 months)
- Platform.sh SAS (for 58 months)
- Moxa Inc. (for 52 months)
- sipgate GmbH (for 49 months)
- OVH US LLC (for 47 months)
- Tilburg University (for 47 months)
- GSI Helmholtzzentrum für Schwerionenforschung GmbH (for 39 months)
- Soliton Systems K.K. (for 36 months)
- THINline s.r.o. (for 12 months)
- Copenhagen Airports A/S (for 5 months)
- Bronze sponsors:
- Evolix (for 129 months)
- Seznam.cz, a.s. (for 129 months)
- Linuxhotel GmbH (for 126 months)
- Intevation GmbH (for 125 months)
- Daevel SARL (for 124 months)
- Bitfolk LTD (for 123 months)
- Megaspace Internet Services GmbH (for 123 months)
- Greenbone AG (for 122 months)
- NUMLOG (for 122 months)
- WinGo AG (for 122 months)
- Entr’ouvert (for 113 months)
- Adfinis AG (for 111 months)
- GNI MEDIA (for 105 months)
- Laboratoire LEGI - UMR 5519 / CNRS (for 105 months)
- Tesorion (for 105 months)
- Bearstech (for 97 months)
- LiHAS (for 97 months)
- Catalyst IT Ltd (for 91 months)
- Supagro (for 87 months)
- Demarcq SAS (for 85 months)
- Université Grenoble Alpes (for 71 months)
- TouchWeb SAS (for 64 months)
- SPiN AG (for 60 months)
- CoreFiling (for 56 months)
- Institut des sciences cognitives Marc Jeannerod (for 51 months)
- Observatoire des Sciences de l’Univers de Grenoble (for 48 months)
- Tem Innovations GmbH (for 43 months)
- WordFinder.pro (for 42 months)
- CNRS DT INSU Résif (for 41 months)
- Alter Way (for 34 months)
- Institut Camille Jordan (for 24 months)
- SOBIS Software GmbH (for 8 months)
- Tuxera Inc.