Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5053

Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

From te3d4q@sigaint.org
Newsgroups linux.debian.security
Subject Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?
Date 2016-10-11 17:10 +0200
Message-ID <sr6QO-8jN-23@gated-at.bofh.it> (permalink)
Organization linux.* mail to news gateway

Show all headers | View raw

I read somewhere on a forum that for security vulnerabilities that have
"NVD security" ratings of medium or low risk, Debian's security team may
not issue patches/fixes for them. Only high-risk security vulnerabilities
will be fixed. Is that correct?

I was under the impression that all security vulnerabilities of whatever
their risk ratings will be fixed.

If you are a member of or know someone who is on Debian's security team,
please clarify ask them to clarify it for me. Thanks.

Back to linux.debian.security | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? te3d4q@sigaint.org - 2016-10-11 17:10 +0200
  Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Mühlenhoff <jmm@inutil.org> - 2016-10-11 17:30 +0200
    Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-11 22:10 +0200
      Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Muehlenhoff <jmm@debian.org> - 2016-10-11 23:10 +0200
        Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-12 12:50 +0200
          Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Michael Stone <mstone@debian.org> - 2016-10-12 17:20 +0200
            Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-13 16:50 +0200
              Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Michael Stone <mstone@debian.org> - 2016-10-13 20:40 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Florian Weimer <fw@deneb.enyo.de> - 2016-10-18 22:30 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? Henrique de Moraes Holschuh <hmh@debian.org> - 2016-10-19 17:00 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Alexander Schreiber <als@thangorodrim.ch> - 2016-10-20 01:00 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? Henrique de Moraes Holschuh <hmh@debian.org> - 2016-10-20 02:40 +0200
          Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Muehlenhoff <jmm@inutil.org> - 2016-10-12 22:40 +0200
            Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-13 16:50 +0200

csiph-web