Date: Fri, 12 Sep 2014 14:03:44 +0200 From: Tomas Hoger <thoger@...hat.com> To: oss-security@...ts.openwall.com Cc: Sven Kieske <s.kieske@...twald.de> Subject: Re: CVE Request: MySQL: MyISAM temporary file issue On Fri, 12 Sep 2014 09:12:18 +0200 Sven Kieske wrote: > Well I hope than that I can soon migrate to mariadb or postgresql. > In other words, to a db which takes security serious and handles > it professional, as this is clearly not professional behaviour. I honestly fail to see MariaDB as a sliver bullet here. No doubt MariaDB upstream is more open with respect to security issues handling and does not seem to obfuscate security flaw details the same way MySQL upstream does. However, I don't believe they have any better visibility into what Oracle assigned CVEs are for. So for example, they likely did not have a way to be sure that CVE-2014-2440 is dupe a of CVE-2014-0001 until it was confirmed elsewhere in this thread. At this point, it seems reasonable to assume that any Oracle assigned CVE most likely affects matching 5.x MariaDB versions, and that it is fixed when MariaDB is rebased to a fixed MySQL version. With 10.x being a full fork no longer being rebased to new MySQL releases, it will become increasingly uncertain if certain MySQL CVE is applicable to MariaDB as well, or to know if it was addressed. -- Tomas Hoger / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ