[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <871tke8ngu.fsf@mid.deneb.enyo.de>
Date: Tue, 24 Mar 2015 15:44:01 +0100
From: Florian Weimer <fw@...eb.enyo.de>
To: oss-security@...ts.openwall.com
Subject: Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier
* Kurt Seifried:
> Another example of why embargoes are a bad idea, these issues have been
> fixed for ages by upstream but fell through the cracks, because embargo!
There is no hard information in those bug reports. It's not clear
what, precisely, they are about, and so it is impossible to tell if
they actually have been fixed. I appreciate that you clean out old
stuff, but doing it this way makes it seem you suddenly have developed
a policy for secrecy around security issues.
> https://bugzilla.redhat.com/show_bug.cgi?id=1063550
(CVE-2014-0048)
Could this be a dupe of the index.docker.io registry misconfiguration
that had at least one redirect to http:// (now fixed) for the actual
(unverified) image data?
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
