oss-sec mailing list archives
Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777
From: John Haxby <john.haxby () oracle com>
Date: Tue, 10 Mar 2015 09:41:22 +0000
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 09/03/15 20:39, Kurt Seifried wrote:
I find this really hard to believe based on the past. So you're saying Oracle is willing to work with Red Hat and the community in general now? Can we get access to the MySQL security bugs and test cases for example? This would be HUGELY helpful to the community.
I have no link to MySQL. You need to take this up with those people.
I'll believe Oracle is willing to work with the community when I actually see Oracle participate and help the community. Until then it's just words from some random Oracle employee and most likely isn't official policy. So prove to us you want to work with us (e.g. by opening up the MySQL security bugs/test cases) and we can definitely look at future cooperation.
I would really like to be able to do that, but this is a political problem outside my control. We, the linux team, already contribute not inconsiderable amounts to the community: we're a big contributor to xen, to parts of the linux kernel including btrfs, ocfs2 (obviously), nfs ... the MAINTAINERS file lists 13 maintainers with @oracle.com maintainers. It wouldn't take a lot of searching to find our contributions to numerous other projects. None of this, however, has anything to do with the matter at hand. If no one from Red Hat is unwilling to cooperate in getting a single backward-compatible resolution to incorporating PEP-466 into the distro python versions then perhaps someone else is. If there's interest, I'll gladly work with anyone who wants to find a way to do this. This is just me trying, as usual, to do the best by everyone. I don't speak for Oracle, I'm not paid enough for that, I'm just trying to make sure that we don't wind up with a backported fix that makes the overall situation worse. So can we please set aside the anti-corporate sentiments? jch -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iF4EAREIAAYFAlT+vDYACgkQRQu7fpQvo8iCJAD/fE7RhFUrNTJkvxkaBBidQvG4 m3VLzug74/zMt/oQFbEA/A2ykhF8V3Cnbvt23OvczCpJOOxr/d9cB0M9m+IvpZtA =mKaH -----END PGP SIGNATURE-----
Current thread:
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777, (continued)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 05)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 05)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Michael Samuel (Mar 05)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 05)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 06)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 06)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 08)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 09)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 09)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 09)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Michael Samuel (Mar 10)
- Re: PEP-466 common compatible implementation. (was ... CVE-2015-1777) John Haxby (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Michael Samuel (Mar 10)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 John Haxby (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Kurt Seifried (Mar 11)
- Re: Another Python app (rhn-setup: rhnreg_ks) not checking hostnames in certs properly CVE-2015-1777 Donald Stufft (Mar 11)