* Re: [yocto] [PATCH] bash: update to latest (025) patchset (fixes CVE-2014-6271) [not found] ` <CAJTo0LYf-qWXia8EuKSnck5=yYLGspckqm27y3kxMDESSdL5Og@mail.gmail.com> @ 2014-09-25 22:48 ` Mark Hatle 2014-09-25 23:15 ` Burton, Ross 0 siblings, 1 reply; 2+ messages in thread From: Mark Hatle @ 2014-09-25 22:48 UTC (permalink / raw) To: yocto, Patches and discussions about the oe-core layer On 9/25/14, 5:40 PM, Burton, Ross wrote: > Hu Francesco, > > On 25 September 2014 11:35, Francesco Del Degan <f.deldegan@endian.com> wrote: >> Updated to reflect the latest patchset in bash 4.3. >> Fixes the CVE-2014-6271. > > I'm hearing that this isn't a complete fix, so lets wait for more patches. > > Is it possible to cherry-pick just the security fixes, instead of > every patch they've released? > > Finally, patches for oe-core should go to openembedded-core@, not yocto@. > > Ross > Patch 025 fixes CVE-2014-6271, but does NOT fix CVE-2014-7169 or possibly two other issues people are currently looking into. (None of this is confidential BTW.. you can all follow along on the oss-security mailing list.) So I would recommend that someone get the 025 patch (don't forget to patch bash 3.2 as well) in.. and we should wait until their is an official one for 7169. --Mark ^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [yocto] [PATCH] bash: update to latest (025) patchset (fixes CVE-2014-6271) 2014-09-25 22:48 ` [yocto] [PATCH] bash: update to latest (025) patchset (fixes CVE-2014-6271) Mark Hatle @ 2014-09-25 23:15 ` Burton, Ross 0 siblings, 0 replies; 2+ messages in thread From: Burton, Ross @ 2014-09-25 23:15 UTC (permalink / raw) To: Mark Hatle Cc: yocto@yoctoproject.org, Patches and discussions about the oe-core layer On 25 September 2014 23:48, Mark Hatle <mark.hatle@windriver.com> wrote: > So I would recommend that someone get the 025 patch (don't forget to patch > bash 3.2 as well) in.. and we should wait until their is an official one for > 7169. Agreed, and patches sent. Ross ^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-09-25 23:15 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <1411641352-19058-1-git-send-email-f.deldegan@endian.com>
[not found] ` <CAJTo0LYf-qWXia8EuKSnck5=yYLGspckqm27y3kxMDESSdL5Og@mail.gmail.com>
2014-09-25 22:48 ` [yocto] [PATCH] bash: update to latest (025) patchset (fixes CVE-2014-6271) Mark Hatle
2014-09-25 23:15 ` Burton, Ross
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox