vcswatch reports that
this package seems to have a new changelog entry (version
1.61.0+ds1-5, distribution
unstable) and new commits
in its VCS. You should consider whether it's time to make
an upload.
Among the 5 debian patches
available in version 1.61.0+ds1-4 of the package,
we noticed the following issues:
5 patches
where the metadata indicates that the patch has not yet been forwarded
upstream. You should either forward the patch upstream or update the
metadata to document its real status.
1 issue left for the package maintainer to handle:
CVE-2024-9676:
(needs triaging)
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.
Migration status for golang-github-containers-storage (1.59.1+ds1-3 to 1.61.0+ds1-4): BLOCKED: Maybe temporary, maybe blocked but Britney is missing information (check below)
![[bug history graph]](https://qa.debian.org/data/bts/graphs/g/golang-github-containers-storage.png){kind=link}