Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5213 > unrolled thread

Re: [SECURITY] [DSA 3823-1] eject security update

Back to article view | Back to linux.debian.security

Contents

  Re: [SECURITY] [DSA 3823-1] eject security update Hideki Yamane <henrich@debian.or.jp> - 2017-04-18 04:00 +0200
    Re: [SECURITY] [DSA 3823-1] eject security update Salvatore Bonaccorso <carnil@debian.org> - 2017-04-19 15:40 +0200

#5213 — Re: [SECURITY] [DSA 3823-1] eject security update

Hi,

I'm just curious, Ubuntu developer said that there was no embargo for
eject package vulnerability with Debian, is it true and if so, why?

https://bugs.launchpad.net/ubuntu/+source/eject/+bug/1673627/comments/3

-- 
Hideki Yamane

[toc] | [next] | [standalone]

#5214

Hi

On Tue, Apr 18, 2017 at 10:50:19AM +0900, Hideki Yamane wrote:
> I'm just curious, Ubuntu developer said that there was no embargo for
> eject package vulnerability with Debian, is it true and if so, why?
> 
> https://bugs.launchpad.net/ubuntu/+source/eject/+bug/1673627/comments/3

Yes this is true. All that is happening after dropping the privileges
should be from trusted source (kernel). The fixes were simple enough
and eject package builds fast enough that there was no need to have an
exact timeframe when Ubuntu and Debian needed to push an update in
sync.

To be on the safe side rather than sorry afterwards, Debian has
released updates as well relatively quickly after the issue went
public via Ubuntu, though.

Hope this helps,

Regards,
Salvatore

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web