[pkg-ntp-maintainers] Bug#823120: Bug#823120: Bug#823120: not fixed in the released version

[Kurt Roeckx]

On Sun, May 07, 2017 at 02:48:26PM +0200, Bernhard Schmidt wrote:
> On 04.05.2017 22:47, Kurt Roeckx wrote:
> 
> Hi Kurt,
> 
> >>> I was checking 1:4.2.8p10+dfsg-1 that should have fixed this.
> >>
> >> No, 1:4.2.8p10+dfsg-1+exp1 (in experimental) should have fixed this, it
> >> has not landed in sid yet (due to being in deep freeze etc)
> >>>
> >>> But still:
> >>> # apt-get install ntpdate ntp
> >>> [...]
> >>> Get:2 http://cdn-fastly.deb.debian.org/debian sid/main amd64 ntpdate amd64
> >>> 1:4.2.8p10+dfsg-1 [72.1 kB]
> >>> # ntpdate-debian
> >>> 3 May 07:44:16 ntpdate[2169]: no servers can be used, exiting
> >>>
> >>> Issue still being the same with the change not applied:
> >>> # grep pool /etc/ntp.conf
> >>> pool 0.debian.pool.ntp.org iburst
> >>> pool 1.debian.pool.ntp.org iburst
> >>> pool 2.debian.pool.ntp.org iburst
> >>> pool 3.debian.pool.ntp.org iburst
> >>>
> >>> # grep pool /usr/sbin/ntpdate-debian
> >>> <nothing>
> >>
> >> Kurt, this is the only change in experimental I would consider to fix
> >> for Stretch, especially since it has been fixed once and got lost
> >> somewhere. What do you think?
> > 
> > And maybe in jessie too.
> 
> I'll ask the release team for a pre-approval, since we're pretty late in
> the freeze and it's not an RC bug.
> 
> If you don't object I'll also include changes to Vcs-* to point to the
> git repo instead of svn.

No problem.

Anyway, I was a little confused, stable doesn't know about pool
yet.

But stable and oldstable have a lot of open CVE issues. If you
have time, it would be nice if at least some of them get fixed.
If you want to fix them, I suggest you don't look at the upstream
fixes and instead look at fedora repository at
http://pkgs.fedoraproject.org/cgit/ntp.git/ to see what patches
they applied to 4.2.6p5. Our patches should be exactly the same,
except for maybe some whitespace changes.


Kurt