Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 21 Apr 2015 21:58:17 -0400
From: Kash Pande <>
Subject: CVE Request for ZFS on Linux


This was "discovered" yesterday.

As outlined here, there is a security issue in the Debian packages for
zfsonlinux which will export NFS shares to * when you only intend for

Some notes:
-> Debian packages for zfsonlinux were using extra patches for NFS,
iSCSI and other shares not present in upstream zfsonlinux
-> These patches were included by the maintainer of the Debian packages
against upstream's wishes

NFS users who are exporting host-specific shares from
CentOS/FreeBSD/illumos who switch to Debian will certainly be surprised
to find their NFS shares are wide open.

Can we have a CVE for tracking this, as it's a unique issue which has
apparently been in the Debian packages for some time now.

No other zfsonlinux distribution suffers these issues.


Kash Pande
Jentu Technologies, Inc.

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.