7 May
2021
7 May
'21
10:21 a.m.
On Fri, May 07, 2021 at 11:06:37AM +0100, Adam Spiers wrote:
And indeed I see the
same presumably vulnerable version listed for buster here:
https://packages.debian.org/search?keywords=exim4&searchon=names&ex…
That list suggests that only sid (unstable), bullseye (testing), and
buster-backports have a fix.
My sources.list is:
deb http://apt-cacher.lon.bitfolk.com/debian/ftp.uk.debian.org/debian/ stable main
contrib
deb-src http://apt-cacher.lon.bitfolk.com/debian/ftp.uk.debian.org/debian/ stable main
contrib
deb http://apt-cacher.lon.bitfolk.com/debian/security.debian.org/
stable/updates main
deb-src http://apt-cacher.lon.bitfolk.com/debian/security.debian.org/
stable/updates main
deb http://apt-cacher.lon.bitfolk.com/debian/ftp.uk.debian.org/debian/
stable-updates main
deb-src http://apt-cacher.lon.bitfolk.com/debian/ftp.uk.debian.org/debian/
stable-updates main
Presumably that means I need to add buster-backports to get it.
I'll try that now.
Well that was slightly more painful than it probably should have been,
but I managed it by adding the following source:
deb http://deb.debian.org/debian buster-backports main
which is documented at https://backports.debian.org/Instructions/
According to https://tools.bitfolk.com/wiki/Apt-cacher#Available_mirrors
I should have been able to prepend apt-cacher.lon.bitfolk.com/debian/
but
deb http://apt-cacher.lon.bitfolk.com/debian/deb.debian.org/debian buster-backports
main
did not work.
Furthermore, as the backports instructions explain, all backports are
deactivated by default (i.e. the packages are pinned to 100), so a
simple "apt install exim4" won't work; instead you need
apt install exim4/buster-backports
I'm sure there's some package pinning voodoo which mitigates the need
for this suffix, but I always found Debian's handling of package
priorities confusing and never got the hang of it.