oss-sec mailing list archives
Re: CVE request: Debian's package "mysql-server" leaks credential information
From: Florian Weimer <fweimer () redhat com>
Date: Mon, 10 Jun 2013 13:37:33 +0200
On 06/10/2013 01:26 PM, gremlin () gremlin ru wrote:
On 08-Jun-2013 13:28:28 -0400, Daniel Kahn Gillmor wrote: >> That's not a security issue, but a misconfiguration > I consider this a security bug in the debian package's maintainer > scripts: it is a race condition that leaks confidential information Package post-install scripts are closer to configuration.
That depends on the post-install script. In Debian's case, there are some extensions because there is still some interactive package installation left, but in general, the postinst script performs required steps for properly integrating the new package with the rest of the system.
For Fedora and downstream, the postinst script should be non-interactive, so it is really not much like configuration.
In general, it's desirable to do as much as possible in a declarative fashion (for better auditing, rollback, etc.), but I don't anyone is even close to that.
Anyway, if there's a bug in the postinstall script that causes an exposure, it needs to be fixed. With the prerm script, it's more complicated because you can't fix it without executing it again. 8-)
-- Florian Weimer / Red Hat Product Security Team
Current thread:
- Re: CVE request: Debian's package "mysql-server" leaks credential information, (continued)
- Re: CVE request: Debian's package "mysql-server" leaks credential information gremlin (Jun 08)
- Re: CVE request: Debian's package "mysql-server" leaks credential information larry Cashdollar (Jun 08)
- Re: CVE request: Debian's package "mysql-server" leaks credential information gremlin (Jun 08)
- Re: CVE request: Debian's package "mysql-server" leaks credential information larry Cashdollar (Jun 08)
- Re: CVE request: Debian's package "mysql-server" leaks credential information gremlin (Jun 08)
- Re: CVE request: Debian's package "mysql-server" leaks credential information larry Cashdollar (Jun 08)
- Re: CVE request: Debian's package "mysql-server" leaks credential information larry Cashdollar (Jun 08)
- Re: CVE request: Debian's package "mysql-server" leaks credential information gremlin (Jun 08)
- Re: CVE request: Debian's package "mysql-server" leaks credential information Kurt Seifried (Jun 08)
- RE: CVE request: Debian's package "mysql-server" leaks credential information Christey, Steven M. (Jun 09)
- Re: CVE request: Debian's package "mysql-server" leaks credential information gremlin (Jun 10)
- Re: CVE request: Debian's package "mysql-server" leaks credential information Florian Weimer (Jun 10)
- Re: CVE request: Debian's package "mysql-server" leaks credential information Henri Salo (Jun 10)