Date: Sat, 08 Jun 2013 13:28:28 -0400 From: Daniel Kahn Gillmor <dkg@...thhorseman.net> To: oss-security@...ts.openwall.com CC: gremlin@...mlin.ru Subject: Re: CVE request: Debian's package "mysql-server" leaks credential information On 06/08/2013 07:00 AM, gremlin@...mlin.ru wrote: > That's not a security issue, but a misconfiguration I consider this a security bug in the debian package's maintainer scripts: it is a race condition that leaks confidential information to a user who "wins" the race. It is *not* a misconfiguration; it is a bug with security implications. > (alas, very common for Deb*an packages) If you know of more bugs like this, please report them with an e-mail to submit@...s.debian.org with the first line "Package: FOO" (where "FOO" is replaced by the name of the buggy package). Thanks! > so at least I doubt that deserves a CVE. I respectfully disagree; if an upstream package leaks confidential information to an adversary who "wins" a race, that is a bug which deserves a CVE. Debian packaging bugs should be held to the same standard. Regards, --dkg (i am a member of the debian project) Download attachment "signature.asc" of type "application/pgp-signature" (1028 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.