Re: CVE-2012-2248: isc-dhcp, Debian-specific: build path included in PATH

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/18/2012 01:35 PM, Michael Gilbert wrote:
> On Wed, Oct 17, 2012 at 8:41 PM, Kurt Seifried wrote:
> > > It was uploaded to and affected Debian testing and unstable. 
> > > Testing has not yet been officially "released", but some people
> > > use testing as if it were an official release.  Unstable never
> > > gets released.
> >
> > When I say released I meant in the sense of made available for 
> > download, not in the sense of software engineering and doing a
> > proper "release".
>
> So, at the risk of sounding nitpicky, the Debian testing +
> unstable archives are pretty much equivalent to Fedora rawhide.
> Even though Redhat's position is that issues affecting only rawhide
> should not get CVE identifiers, in Debian I think we should try to
> be more honest, so we'll assign identifiers to all "uploaded"
> versions (in Debian, we use the term upload to mean that a package
> is available in an archive vice the term release).

Part of it also depends on usage. Google labels everything as a Beta,
sometimes for years and with millions of users. My experience is a lot
of people use Debian unstable (when I used Debian I did, otherwise
everything was to boring =). What would be interesting is if you could
provide download statistics from the main site. I know for a fact
CVE's have been assigned for publicly released applications that are
probably in use by less than 100 or in extreme cases possibly less
than 10 people globally.

> Best wishes, Mike

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/

iQIcBAEBAgAGBQJQgGQ6AAoJEBYNRVNeJnmTKXQP/joBpBQnvha7YENjPIoDdNl4
VFaleMmBXx2ozTRsxj9mJ24yqHUSTmvzj5pAbnmg9zBzVJay2FiY0/c5kRTL9plU
2CloMtQ3jmPbPONVZo8op8YT5j1h4OB3SUAYh5Ac4Z9HZ2xOWmi9cTA2pO0jxnq3
HiL+dyaqgxnLF8DUEYVYSP9q9qklLnm1lT1VU+ZrjXMvTYn40HwPHFF70pa42pkl
s/LQG9GsKg94iLZJvA8Q/7cZ65NyfKBsXnU6z0+Qfb7Siod2HGfm6DR1MgTc3x/h
2EJdHFgpUtEIddI4zmdjFQw9yTk77sXfEq8qK+CuLGI35VEVOoiN2+GlL0AqOzeY
Jz/fCxav5XjV4HP3eyN4SW1WCtXi62WoMPWn58dRyZDEy9Yr20qNL7u4BrG8jrVA
RmASwWPmsDggQpWWmb5GYKVGTcHxjrjr+1hNuH6cQRPvA3SIT4iGb8A9r7KEaws2
UeQjP0pkdI3MjFjmGOTNDeK50cRScqH2dyNn+NPQJJxP698TtRVFaSWaWH8aWgs1
ZeqFbkICf6JOQo5uCnZuG23wz0C2mOBLWSEfZgSi8iNSnhnUKRuBu/36BJEbbRz8
8idGPrgf+6Bl38mOxdYTrds/ftr0ocnm5hQcP22Hyoy/eYBeKg14jbIdPhaJ69ub
yAjuinXcXh2xZT9+7OyM
=dSbi
-----END PGP SIGNATURE-----