oss-sec mailing list archives
Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging
From: Jan Lehnardt <jan () apache org>
Date: Mon, 9 May 2022 12:36:58 +0200
On 9. May 2022, at 11:46, Archange <archange () activis me> wrote: Le 09/05/2022 à 13:41, Jan Lehnardt a écrit :Hi Bruno, first of all, thanks for maintaining CouchDB for Arch. Secondly, for any security related questions, please do not hesitate to contact security () couchdb apache org instead of any one of the team individually, as we can’t know if any of is available at all times (vacations and whatnot :)Sure, you should put this address in copy when posting to oss-security then, so you would be sure people reply to that one too. ;)
This is automated by ASF infrastructure, I sadly have no say over this. But maybe we can a footer with the address next time :)
As for your questions, see this PR to our packaging infrastructure for how we handle this on Debian and Centos/Rocky: https://github.com/apache/couchdb-pkg/pull/92/filesThanks, so you use a default env file to set the variable and allow people to easily change it in the case of a clustered setup. Will do so as well then!
Perfect, thanks! Jan —
Current thread:
- CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging Jan Lehnardt (Apr 26)
- Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging Archange (May 09)
- Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging Jan Lehnardt (May 09)
- Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging Archange (May 09)
- Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging Jan Lehnardt (May 09)
- Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging Jan Lehnardt (May 09)
- Re: CVE-2022-24706: Apache CouchDB: Remote Code Execution Vulnerability in Packaging Archange (May 09)