* Re: [yocto] [PATCH] bash: update to latest (025) patchset (fixes CVE-2014-6271)
[not found] ` <CAJTo0LYf-qWXia8EuKSnck5=yYLGspckqm27y3kxMDESSdL5Og@mail.gmail.com>
@ 2014-09-25 22:48 ` Mark Hatle
2014-09-25 23:15 ` Burton, Ross
0 siblings, 1 reply; 2+ messages in thread
From: Mark Hatle @ 2014-09-25 22:48 UTC (permalink / raw)
To: yocto, Patches and discussions about the oe-core layer
On 9/25/14, 5:40 PM, Burton, Ross wrote:
> Hu Francesco,
>
> On 25 September 2014 11:35, Francesco Del Degan <f.deldegan@endian.com> wrote:
>> Updated to reflect the latest patchset in bash 4.3.
>> Fixes the CVE-2014-6271.
>
> I'm hearing that this isn't a complete fix, so lets wait for more patches.
>
> Is it possible to cherry-pick just the security fixes, instead of
> every patch they've released?
>
> Finally, patches for oe-core should go to openembedded-core@, not yocto@.
>
> Ross
>
Patch 025 fixes CVE-2014-6271, but does NOT fix CVE-2014-7169 or possibly two
other issues people are currently looking into. (None of this is confidential
BTW.. you can all follow along on the oss-security mailing list.)
So I would recommend that someone get the 025 patch (don't forget to patch bash
3.2 as well) in.. and we should wait until their is an official one for 7169.
--Mark
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [yocto] [PATCH] bash: update to latest (025) patchset (fixes CVE-2014-6271)
2014-09-25 22:48 ` [yocto] [PATCH] bash: update to latest (025) patchset (fixes CVE-2014-6271) Mark Hatle
@ 2014-09-25 23:15 ` Burton, Ross
0 siblings, 0 replies; 2+ messages in thread
From: Burton, Ross @ 2014-09-25 23:15 UTC (permalink / raw)
To: Mark Hatle
Cc: yocto@yoctoproject.org,
Patches and discussions about the oe-core layer
On 25 September 2014 23:48, Mark Hatle <mark.hatle@windriver.com> wrote:
> So I would recommend that someone get the 025 patch (don't forget to patch
> bash 3.2 as well) in.. and we should wait until their is an official one for
> 7169.
Agreed, and patches sent.
Ross
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-09-25 23:15 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <1411641352-19058-1-git-send-email-f.deldegan@endian.com>
[not found] ` <CAJTo0LYf-qWXia8EuKSnck5=yYLGspckqm27y3kxMDESSdL5Og@mail.gmail.com>
2014-09-25 22:48 ` [yocto] [PATCH] bash: update to latest (025) patchset (fixes CVE-2014-6271) Mark Hatle
2014-09-25 23:15 ` Burton, Ross
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox