From: Mark Hatle <mark.hatle@windriver.com>
To: <yocto@yoctoproject.org>,
Patches and discussions about the oe-core layer
<openembedded-core@lists.openembedded.org>
Subject: Re: [yocto] [PATCH] bash: update to latest (025) patchset (fixes CVE-2014-6271)
Date: Thu, 25 Sep 2014 17:48:56 -0500 [thread overview]
Message-ID: <54249BD8.1030702@windriver.com> (raw)
In-Reply-To: <CAJTo0LYf-qWXia8EuKSnck5=yYLGspckqm27y3kxMDESSdL5Og@mail.gmail.com>
On 9/25/14, 5:40 PM, Burton, Ross wrote:
> Hu Francesco,
>
> On 25 September 2014 11:35, Francesco Del Degan <f.deldegan@endian.com> wrote:
>> Updated to reflect the latest patchset in bash 4.3.
>> Fixes the CVE-2014-6271.
>
> I'm hearing that this isn't a complete fix, so lets wait for more patches.
>
> Is it possible to cherry-pick just the security fixes, instead of
> every patch they've released?
>
> Finally, patches for oe-core should go to openembedded-core@, not yocto@.
>
> Ross
>
Patch 025 fixes CVE-2014-6271, but does NOT fix CVE-2014-7169 or possibly two
other issues people are currently looking into. (None of this is confidential
BTW.. you can all follow along on the oss-security mailing list.)
So I would recommend that someone get the 025 patch (don't forget to patch bash
3.2 as well) in.. and we should wait until their is an official one for 7169.
--Mark
next parent reply other threads:[~2014-09-25 22:48 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <1411641352-19058-1-git-send-email-f.deldegan@endian.com>
[not found] ` <CAJTo0LYf-qWXia8EuKSnck5=yYLGspckqm27y3kxMDESSdL5Og@mail.gmail.com>
2014-09-25 22:48 ` Mark Hatle [this message]
2014-09-25 23:15 ` [yocto] [PATCH] bash: update to latest (025) patchset (fixes CVE-2014-6271) Burton, Ross
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=54249BD8.1030702@windriver.com \
--to=mark.hatle@windriver.com \
--cc=openembedded-core@lists.openembedded.org \
--cc=yocto@yoctoproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox