ckeditor - Debian Package Tracker

general

source: ckeditor (main)
version: 4.19.1+dfsg-1
maintainer: Debian Javascript Maintainers (archive) (DMD)
uploaders: Dmitry Smirnov [DMD] – Bastien Roucariès [DMD]
arch: all
std-ver: 4.6.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 4.5.7+dfsg-2
o-o-sec: 4.5.7+dfsg-2+deb9u1
oldstable: 4.11.1+dfsg-1
stable: 4.16.0+dfsg-2
testing: 4.19.1+dfsg-1
unstable: 4.19.1+dfsg-1

versioned links

4.5.7+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.5.7+dfsg-2+deb9u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.11.1+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.16.0+dfsg-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
4.19.1+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

ckeditor

action needed

A new upstream version is available: 4.20.0 high

A new upstream version 4.20.0 is available, you should consider packaging it.

Created: 2022-09-30 Last update: 2022-12-02 12:00

lintian reports 502 errors and 5 warnings high

Lintian reports 502 errors and 5 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2021-09-06 Last update: 2022-07-30 12:12

Depends on packages which need a new maintainer normal

The packages that ckeditor depends on which need a new maintainer are:

closure-compiler (#1008632)
- Build-Depends: closure-compiler

Created: 2022-03-29 Last update: 2022-12-02 16:11

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2022-11-26 Last update: 2022-12-02 12:03

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 4.19.1+dfsg-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 2bd2eb1b7d31bbeca223b2995deac7a606a4433c
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Fri Nov 4 20:08:17 2022 +0000

    Set upstream metadata fields: Repository-Browse, Security-Contact.
    
    Changes-By: lintian-brush

commit 1a95f8a134d9ce63520a553b255394ed02a0e4eb
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Fri Nov 4 20:07:58 2022 +0000

    Update lintian override info to new format on line 4-5, 9-10, 15-16, 18-19, 22-23.
    
    Changes-By: lintian-brush
    Fixes: lintian: mismatched-override
    See-also: https://lintian.debian.org/tags/mismatched-override.html

commit 14506489cbf4367a7c975dceccae1010f86ccc74
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Thu Jul 28 08:56:18 2022 +0000

    Remove constraints unnecessary since buster
    
    * Build-Depends: Drop versioned constraint on ckbuilder.
    
    Changes-By: deb-scrub-obsolete

commit 4f638ebda43ad279cae91d86029914513a4da043
Merge: d1c6031d d66a48b5
Author: Yadd <yadd@debian.org>
Date:   Thu Jul 28 08:33:39 2022 +0200

    Merge remote-tracking branch 'origin/master'

commit d66a48b5b53de5535a8f6188d71a2d9d671d2581
Author: Dmitry Smirnov <onlyjob@debian.org>
Date:   Mon Jul 18 18:32:26 2022 +1000

    Removed myself from Uploaders.

Created: 2022-07-18 Last update: 2022-11-30 08:36

7 low-priority security issues in bullseye low

There are 7 open security issues in bullseye.

7 issues left for the package maintainer to handle:

CVE-2021-32808: (needs triaging) ckeditor is an open source WYSIWYG HTML editor with rich content support. A vulnerability has been discovered in the clipboard Widget plugin if used alongside the undo feature. The vulnerability allows a user to abuse undo functionality using malformed widget HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version >= 4.13.0. The problem has been recognized and patched. The fix will be available in version 4.16.2.
CVE-2021-32809: (needs triaging) ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Clipboard](https://ckeditor.com/cke4/addon/clipboard) package. The vulnerability allowed to abuse paste functionality using malformed HTML, which could result in injecting arbitrary HTML into the editor. It affects all users using the CKEditor 4 plugins listed above at version >= 4.5.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
CVE-2021-37695: (needs triaging) ckeditor is an open source WYSIWYG HTML editor with rich content support. A potential vulnerability has been discovered in CKEditor 4 [Fake Objects](https://ckeditor.com/cke4/addon/fakeobjects) package. The vulnerability allowed to inject malformed Fake Objects HTML, which could result in executing JavaScript code. It affects all users using the CKEditor 4 plugins listed above at version < 4.16.2. The problem has been recognized and patched. The fix will be available in version 4.16.2.
CVE-2021-41164: (needs triaging) CKEditor4 is an open source WYSIWYG HTML editor. In affected versions a vulnerability has been discovered in the Advanced Content Filter (ACF) module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
CVE-2021-41165: (needs triaging) CKEditor4 is an open source WYSIWYG HTML editor. In affected version a vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4. The vulnerability allowed to inject malformed comments HTML bypassing content sanitization, which could result in executing JavaScript code. It affects all users using the CKEditor 4 at version < 4.17.0. The problem has been recognized and patched. The fix will be available in version 4.17.0.
CVE-2022-24728: (needs triaging) CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. A vulnerability has been discovered in the core HTML processing module and may affect all plugins used by CKEditor 4 prior to version 4.18.0. The vulnerability allows someone to inject malformed HTML bypassing content sanitization, which could result in executing JavaScript code. This problem has been patched in version 4.18.0. There are currently no known workarounds.
CVE-2022-24729: (needs triaging) CKEditor4 is an open source what-you-see-is-what-you-get HTML editor. CKEditor4 prior to version 4.18.0 contains a vulnerability in the `dialog` plugin. The vulnerability allows abuse of a dialog input validator regular expression, which can cause a significant performance drop resulting in a browser tab freeze. A patch is available in version 4.18.0. There are currently no known workarounds.

You can find information about how to handle these issues in the security team's documentation.

Created: 2022-07-04 Last update: 2022-09-25 16:12

news

[rss feed]

[2022-08-02] ckeditor 4.19.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-07-28] Accepted ckeditor 4.19.1+dfsg-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-07-22] ckeditor 4.19.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-07-16] Accepted ckeditor 4.19.0+dfsg-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2021-11-08] Accepted ckeditor 4.5.7+dfsg-2+deb9u1 (source) into oldoldstable (Utkarsh Gupta)
[2021-08-23] ckeditor 4.16.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2021-08-17] Accepted ckeditor 4.16.2+dfsg-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2021-06-16] ckeditor 4.16.0+dfsg-2 MIGRATED to testing (Debian testing watch)
[2021-06-11] Accepted ckeditor 4.16.0+dfsg-2 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2021-04-12] ckeditor 4.16.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2021-03-07] Accepted ckeditor 4.16.0+dfsg-1 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2019-09-12] ckeditor 4.12.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2019-09-03] Accepted ckeditor 4.12.1+dfsg-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2018-11-17] ckeditor 4.11.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2018-11-14] Accepted ckeditor 4.11.1+dfsg-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2018-11-04] ckeditor 4.10.1+dfsg-1 MIGRATED to testing (Debian testing watch)
[2018-10-30] Accepted ckeditor 4.10.1+dfsg-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2018-08-12] ckeditor 4.10.0+dfsg-1 MIGRATED to testing (Debian testing watch)
[2018-08-06] Accepted ckeditor 4.10.0+dfsg-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2018-06-24] ckeditor 4.9.2+dfsg-2 MIGRATED to testing (Debian testing watch)
[2018-06-19] Accepted ckeditor 4.9.2+dfsg-2 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2018-06-17] ckeditor 4.9.2+dfsg-1 MIGRATED to testing (Debian testing watch)
[2018-06-12] Accepted ckeditor 4.9.2+dfsg-1 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2018-06-09] ckeditor 4.5.7+dfsg-3 MIGRATED to testing (Debian testing watch)
[2018-06-04] Accepted ckeditor 4.5.7+dfsg-3 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2016-03-15] Accepted ckeditor 4.5.7+dfsg-2~bpo8+1 (source all) into jessie-backports, jessie-backports (Dmitry Smirnov)
[2016-02-18] ckeditor 4.5.7+dfsg-2 MIGRATED to testing (Debian testing watch)
[2016-02-13] Accepted ckeditor 4.5.7+dfsg-2 (source all) into unstable (Dmitry Smirnov)
[2016-02-12] Accepted ckeditor 4.5.7+dfsg-1 (source all) into unstable (Dmitry Smirnov)
[2016-02-10] Accepted ckeditor 4.5.6+dfsg-1 (source all) into unstable (Dmitry Smirnov)

bugs [bug history graph]

all: 0

links

homepage
lintian (502, 5)
buildd: logs, reproducibility
popcon
browse source code
edit tags
other distros
security tracker
screenshots

ubuntu

[Information about Ubuntu for Debian Developers]

version: 4.19.1+dfsg-1
1 bug