[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <51B369BC.2050605@fifthhorseman.net>
Date: Sat, 08 Jun 2013 13:28:28 -0400
From: Daniel Kahn Gillmor <dkg@...thhorseman.net>
To: oss-security@...ts.openwall.com
CC: gremlin@...mlin.ru
Subject: Re: CVE request: Debian's package "mysql-server" leaks
credential information
On 06/08/2013 07:00 AM, gremlin@...mlin.ru wrote:
> That's not a security issue, but a misconfiguration
I consider this a security bug in the debian package's maintainer
scripts: it is a race condition that leaks confidential information to a
user who "wins" the race. It is *not* a misconfiguration; it is a bug
with security implications.
> (alas, very common for Deb*an packages)
If you know of more bugs like this, please report them with an e-mail to
submit@...s.debian.org with the first line "Package: FOO" (where "FOO"
is replaced by the name of the buggy package). Thanks!
> so at least I doubt that deserves a CVE.
I respectfully disagree; if an upstream package leaks confidential
information to an adversary who "wins" a race, that is a bug which
deserves a CVE. Debian packaging bugs should be held to the same standard.
Regards,
--dkg (i am a member of the debian project)
Download attachment "signature.asc" of type "application/pgp-signature" (1028 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
