A DSA is needed for the following source packages in old/stable. The specific
CVE IDs do not need to be listed, they can be gathered in an up-to-date manner from
https://security-tracker.debian.org/tracker/source-package/SOURCEPACKAGE
when working on an update.

Some packages are not tracked here:
- Linux kernel (tracking in kernel-sec repo)
- Embargoed issues continue to be tracked in separate file.

To pick an issue, simply add your uid behind it.

If needed, specify the release by adding a slash after the name of the source package.

--
asterisk/oldstable
--
cacti
--
cifs-utils (carnil)
--
curl
--
epiphany-browser
--
freecad (aron)
--
libpgjava (apo)
--
linux (carnil)
  Wait until more issues have piled up, though try to regulary rebase for point
  releases to more recent v4.19.y versions.
--
ndpi/oldstable
--
nodejs (jmm)
--
puma/oldstable
--
rpki-client/stable
  new 7.6 release required libretls, which isn't in Bullseye
--
rsyslog (carnil)
  Assessment ongoing with maintainer to see if warranted
--
salt
--
slurm-llnl/oldstable
--
slurm-wlm/stable
--
smarty3 (apo)
--
sox
--
spi (seb)
  2022-05-25: maintainer proposed debdiffs
--
thunderbird (jmm)
--
trafficserver (jmm)
  wait until status for CVE-2021-38161 is clarified (upstream patch got reverted)
  Maintainer prepared debdiffs for review for a set of CVEs
--
unzip
  unclear information, initial report indicates writable memory corruption, but
  some identified patch is just for a NULL deref, needs more clarification
--
waitress (jmm)
--
wordpress
--
webkit2gtk
--
wpewebkit
--