There are 2 open security issues in buster.
2 issues left for the package maintainer to handle:
- CVE-2020-24614:
(needs triaging)
Fossil before 2.10.2, 2.11.x before 2.11.2, and 2.12.x before 2.12.1 allows remote authenticated users to execute arbitrary code. An attacker must have check-in privileges on the repository.
- CVE-2021-36377:
(needs triaging)
Fossil before 2.14.2 and 2.15.x before 2.15.2 often skips the hostname check during TLS certificate validation.
You can find information about how to handle these issues in the security team's documentation.
![[bug history graph]](https://qa.debian.org/data/bts/graphs/f/fossil.png){kind=link}