Re: CVE Request: MySQL: MyISAM temporary file issue

[Tomas Hoger <thoger () redhat com>]

On Fri, 12 Sep 2014 09:12:18 +0200 Sven Kieske wrote:

> Well I hope than that I can soon migrate to mariadb or postgresql.
> In other words, to a db which takes security serious and handles
> it professional, as this is clearly not professional behaviour.

I honestly fail to see MariaDB as a sliver bullet here.  No doubt
MariaDB upstream is more open with respect to security issues handling
and does not seem to obfuscate security flaw details the same way MySQL
upstream does.  However, I don't believe they have any better
visibility into what Oracle assigned CVEs are for.  So for example, they
likely did not have a way to be sure that CVE-2014-2440 is dupe a of
CVE-2014-0001 until it was confirmed elsewhere in this thread.

At this point, it seems reasonable to assume that any Oracle assigned
CVE most likely affects matching 5.x MariaDB versions, and that it is
fixed when MariaDB is rebased to a fixed MySQL version.  With 10.x being
a full fork no longer being rebased to new MySQL releases, it will
become increasingly uncertain if certain MySQL CVE is applicable to
MariaDB as well, or to know if it was addressed.

-- 
Tomas Hoger / Red Hat Product Security