Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 10 Aug 2012 22:12:22 -0700
From: Russ Allbery <>
To: Kurt Seifried <>
Subject: Re: CVE Request: rssh command-line parsing vulnerability

Kurt Seifried <> writes:

> Not sure why I didn't get this a CVE earlier, please use CVE-2012-3478
> for this issue. Red Hat reference:

Thanks!  I'm happy to share the patches that I have for the Debian package
if Red Hat would also like to use them.  They're somewhat different than
upstream (or, rather, I had to layer additional patches on top of
upstream) because Debian adds support for the new rsync protocol flags and
for svnserve as a supported program, which required changes to the patch.

Russ Allbery (             <>

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.