[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier
From:       Florian Weimer <fw () deneb ! enyo ! de>
Date:       2015-03-31 18:40:55
Message-ID: 87d23prow8.fsf () mid ! deneb ! enyo ! de
[Download RAW message or body]

* Kurt Seifried:

> On 03/24/2015 08:44 AM, Florian Weimer wrote:
>> * Kurt Seifried:
>> 
>>> Another example of why embargoes are a bad idea, these issues have been
>>> fixed for ages by upstream but fell through the cracks, because embargo!
>> 
>> There is no hard information in those bug reports.  It's not clear
>> what, precisely, they are about, and so it is impossible to tell if
>> they actually have been fixed.  I appreciate that you clean out old
>> stuff, but doing it this way makes it seem you suddenly have developed
>> a policy for secrecy around security issues.
>
> tjay@  (our docker guy) verified they were fixed as you can see from his
> comments in the bugs.
>
> This is an example of why we need to clean these old things out. Nobody
> really cares about them, and in all likelihood they got fixed by upstream.

Well, it's been an interesting experience to be on the other side of
the information deficit for once.  Usually, it's us who complain about
certain upstreams who say that they have fixed some vulnerabilities in
a new release (along with tons of other fixes), list a few CVEs, but
without any details what was actually fixed.

In any case, my immediate need for this information is gone.  Debian
jessie will not release with the docker.io package.  (Previously, it
was at version 1.3.3, which is why I was a bit concerned.)
[prev in list] [next in list] [prev in thread] [next in thread]