The following contributions were made:

• Working on fixes for ceph. Had build issues due to the extreme disk usage for the build. Were able to free up some 50G of disk space that is required for this build. Starting to realize that I may not be able to test the update but one problem at a time. Was able to complete the following:
  • CVE-2018-16889 - the code is different so the patch does not apply cleanly. The code is still vulnerable. Work in progress. It should be simply to make a manual patch but requires more testing.
  • CVE-2020-1760 - patch applied
  • CVE-2020-10753 - patch applied
  • CVE-2018-16846 - work remains
  • CVE-2018-14662 - work remains
• Looked through the issues for samba. All issues are postponed for buster. Think we can do the same for stretch. Contacted Roberto about where the patches he mentioned are. Will remove the entry from dla-needed.txt and mark the CVEs as postponed as soon as I get the patch information from Roberto. After this there were some email discussion on this matter. At the time of writing this, it was not yet concluded. But Roberto attached the patches to one of the emails so they are available now.