Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 10 Jun 2013 13:37:33 +0200
From: Florian Weimer <>
Subject: Re: CVE request: Debian's package "mysql-server" leaks
 credential information

On 06/10/2013 01:26 PM, wrote:
> On 08-Jun-2013 13:28:28 -0400, Daniel Kahn Gillmor wrote:
>   >> That's not a security issue, but a misconfiguration
>   > I consider this a security bug in the debian package's maintainer
>   > scripts: it is a race condition that leaks confidential information
> Package post-install scripts are closer to configuration.

That depends on the post-install script.  In Debian's case, there are 
some extensions because there is still some interactive package 
installation left, but in general, the postinst script performs required 
steps for properly integrating the new package with the rest of the system.

For Fedora and downstream, the postinst script should be 
non-interactive, so it is really not much like configuration.

In general, it's desirable to do as much as possible in a declarative 
fashion (for better auditing, rollback, etc.), but I don't anyone is 
even close to that.

Anyway, if there's a bug in the postinstall script that causes an 
exposure, it needs to be fixed.  With the prerm script, it's more 
complicated because you can't fix it without executing it again. 8-)

Florian Weimer / Red Hat Product Security Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.