[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <aQMCZWK1xr3-3DeO@eldamar.lan>
Date: Thu, 30 Oct 2025 07:15:01 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: Questionable CVE's reported against dnsmasq
Hi,
On Mon, Oct 27, 2025 at 09:40:35PM +0100, Sebastian Pipping wrote:
> Hello Stuart,
>
>
> On 10/27/25 20:45, Stuart Henderson wrote:
> > On 2025/10/27 19:51, Sebastian Pipping wrote:
> > > Also, fixes without a CVE will not be backported downstream.
> >
> > That depends on the downstream.
>
> I'm happy to learn which downstreams backport security issues
> without a CVE, in practice. Do you have an example or two?
Another very recent example is
https://lists.debian.org/debian-security-announce/2025/msg00200.html
It is about:
https://discuss.tryton.org/t/security-release-for-issue-14290/8895
https://foss.heptapod.net/tryton/tryton/-/issues/14290
While it would be nice that a identifier exists for this issue (has
not yet happend), this was not blocking doing an update.
Regards,
Salvatore
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
