[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20090123140039.054600a9@redhat.com>
Date: Fri, 23 Jan 2009 14:00:39 +0100
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley@...us.mitre.org
Subject: Re: CVE request -- git
On Thu, 22 Jan 2009 17:17:39 -0500 (EST) "Steven M. Christey"
<coley@...us.mitre.org> wrote:
> > Looks like they got texts mixed up. -5516 was given to git_search
> > issue, and -5517 to git_snapshot and git_object issues (the idea was
> > to use lower id for the issue fixed earlier). Btw, commitdiff
> > links are correct, only texts need swapping.
>
> Fixed.
Good, looks better.
> > Can you also change "in 1.5.x" to "before 1.5.x" in both
> > descriptions?
>
> Done (modulo CVE style).
Plus one extraneous version change ;). Description for -5516 is
supposed to say "before 1.5.5" (as 1.5.5.0, but upstream does not seem
to use trailing ".0"s in version strings) (I have not looked whether
only 1.5.x were affected by this, this may possibly go back to older
versions), one for -5517 should say "before 1.5.6". Version difference
was the reason for split / assignment of 2 CVEs.
> > Their announcement mentions version 1.5.6.6, that should have both
> > issues fixed (and -5916). They'll probably clarify what was their
> > "old" version.
>
> If they're releasing 1.5.6.6, doesn't that suggest that maybe one of
> the issues were still present in 1.5.5?
Paragraph above should explain this. Additionally, they probably just
bumped to upstream version that has all three (-5516, -5517, and -5916)
issues fixed. Not sure what was their previous version though.
HTH
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
