Re: CVE-2014-6271: remote code execution through bash

[Huzaifa Sidhpurwala <huzaifas () redhat com>]

On 09/25/2014 09:49 PM, Solar Designer wrote:

> I agree.  I only suggested it as an interim measure if you felt that a
> more invasive change was not acceptable yet.
>
> I think Florian's prefix-suffix patch is actually a better way to go
> (right now, unless there's some drawback I am not yet aware of), and at
> a later time function imports should require to be enabled with a
> non-default option.

I agree with Alexander here, and strongly suggest that we should be 
using Florain's prefix-suffix patch.


--
Huzaifa Sidhpurwala / Red Hat Product Security Team