[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CACYkhxgmsOG7H3FKhjvDQTfg_WptW1bv19q2CrcPLFTsdL+GiQ@mail.gmail.com>
Date: Wed, 9 Jul 2014 16:40:26 +1000
From: Michael Samuel <mik@...net.net>
To: Poul-Henning Kamp <phk@....freebsd.dk>
Cc: oss-security@...ts.openwall.com
Subject: Re: Re: Varnish - no CVE == bug regression
On 9 July 2014 16:13, Poul-Henning Kamp <phk@....freebsd.dk> wrote:
> No, a restart shuts all connections.
>
> The master process' job is to hold the configured stated and start/stop
> the worker process. As part of the startup the socket is opened & bound,
> but the master does not have anything to do with client sockets. This
> is mainly a security decision: The master must be involatile.
I'm not disagreeing with that decision (which obviously has it's own
merits), but if that's the case then this is a low-risk, low impact DoS
vulnerability.
A CVE assignment will trigger out-of-band patches for distros that might
not do so otherwise. Surely you agree that this is desirable?
Regards,
Michael
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
