Re: [OSSA 2013-013] Keystone client local information disclosure (CVE-2013-2013)

[Jeremy Stanley <fungi () yuggoth org>]

On 2013-06-03 10:51:19 -0700 (-0700), Lloyd Dewolf wrote:
[...]
> Interestingly, the OSSA 2013-014 notice did include
> "python-keystoneclient fix (will be included in upcoming 0.2.4
> release)".

I'm going to chalk that up to Thierry knowing the version number at
that point, since the OSSA 2013-014 fix is what got tagged with
0.2.4 the next morning. On the other hand the -013 fix was a
lower-priority feature enhancement and I didn't want to rely on a
versioning guess a week ahead. Client releases are handled a bit
more independently compared to OpenStack server components (where we
can predict release milestone dates fairly accurately).

As a general rule I'm going to try to include the release version
numbers in advance when I can do so safely, and otherwise rely on
subsequent release announcements.
-- 
Jeremy Stanley