Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 Mar 2015 09:41:22 +0000
From: John Haxby <>
Subject: Re: Another Python app (rhn-setup: rhnreg_ks) not
 checking hostnames in certs properly CVE-2015-1777

Hash: SHA256

On 09/03/15 20:39, Kurt Seifried wrote:
> I find this really hard to believe based on the past. So you're
> saying Oracle is willing to work with Red Hat and the community in
> general now? Can we get access to the MySQL security bugs and test
> cases for example? This would be HUGELY helpful to the community.

I have no link to MySQL.   You need to take this up with those people.

> I'll believe Oracle is willing to work with the community when I 
> actually see Oracle participate and help the community. Until then
> it's just words from some random Oracle employee and most likely
> isn't official policy.
> So prove to us you want to work with us (e.g. by opening up the
> MySQL security bugs/test cases) and we can definitely look at
> future cooperation.

I would really like to be able to do that, but this is a political
problem outside my control.

We, the linux team, already contribute not inconsiderable amounts to
the community: we're a big contributor to xen, to parts of the linux
kernel including btrfs, ocfs2 (obviously), nfs ... the MAINTAINERS
file lists 13 maintainers with maintainers.   It wouldn't
take a lot of searching to find our contributions to numerous other

None of this, however, has anything to do with the matter at hand.  If
no one from Red Hat is unwilling to cooperate in getting a single
backward-compatible resolution to incorporating PEP-466 into the
distro python versions then perhaps someone else is.

If there's interest, I'll gladly work with anyone who wants to find a
way to do this.   This is just me trying, as usual, to do the best by
everyone.  I don't speak for Oracle, I'm not paid enough for that, I'm
just trying to make sure that we don't wind up with a backported fix
that makes the overall situation worse.

So can we please set aside the anti-corporate sentiments?
Version: GnuPG v1


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.