Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 24 Mar 2015 12:30:45 -0600
From: Kurt Seifried <>
Subject: Re: 2 moderate (borderline low) docker flaws fixed
 in >=1.5 and possibly earlier

On 03/24/2015 08:44 AM, Florian Weimer wrote:
> * Kurt Seifried:
>> Another example of why embargoes are a bad idea, these issues have been
>> fixed for ages by upstream but fell through the cracks, because embargo!
> There is no hard information in those bug reports.  It's not clear
> what, precisely, they are about, and so it is impossible to tell if
> they actually have been fixed.  I appreciate that you clean out old
> stuff, but doing it this way makes it seem you suddenly have developed
> a policy for secrecy around security issues.

tjay@  (our docker guy) verified they were fixed as you can see from his
comments in the bugs.

This is an example of why we need to clean these old things out. Nobody
really cares about them, and in all likelihood they got fixed by upstream.

> (CVE-2014-0048)
> Could this be a dupe of the registry misconfiguration
> that had at least one redirect to http:// (now fixed) for the actual
> (unverified) image data?

No, this was stuff like downloading debian signing keys over http rather
than https, and other sensitive content in similarly unsafe ways.

Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.