Repository navigation
Conversation
ianballou
left a comment
ianballou
left a comment
There was a problem hiding this comment.
+1 to the changes here looking back at the history as a Katello maintainer.
Clarified information regarding the 3.4.5.58 release and its status.
| malformed SQL query to the backend database, which will leak internal IDs. | ||
|
|
||
| This is issue is related to an incomplete fix for CVE-2016-3072 | ||
| (Patched in 2.4.3 on June 13, 2016). Version 3.10 (3.10.0 was |
There was a problem hiding this comment.
Here is 3.10 mentioned, but later patched is >= 3.5.0 🤔 .
There was a problem hiding this comment.
Does the note section answer your question?
There was a problem hiding this comment.
@lzap and @ianballou - Can you answer @simi question/comment?
There was a problem hiding this comment.
Found "wontfix" on 9/29/2019 in https://bugzilla.redhat.com/show_activity.cgi?id=1623719
There was a problem hiding this comment.
Since I have not gotten an answer to the 3.5 vs 3.10 question, I am going to cancel PR.
There was a problem hiding this comment.
The answer is indeed in the notes section below: this issue was patched in Katello 3.5.0 and above.
3.5.0 commit: Katello/katello@3a7b130
Original 3.6.0.rc1 commit which was cherry-picked back to 3.5.0: Katello/katello@2e39aff
|
Guys, frankly I am confused what are we doing in here. We were pulled into some process of reviewing old advisories (?) and asked to clear some things out of nowhere which we did. I do not need to explain how things are in FOSS security, we are being hammered by inquiries and reports the same way as you guys do. A one-week turnaround for a non-urgent case is perfectly fine if you ask me.
As much as I would love to help, I have no idea what your expectation was. I do not have the context, I wish I could help. |
|
I am going to delete my previous comment. I am sorry. |
|
Fight copilot with above advisory. Decided to fix grammer 1st. |
Added patched_version to 1 (katello) existing advisory
NOTE: After much research and contacting the project, I now have the
patched_versionfor this advisory.