oss-sec mailing list archives
Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier
From: Florian Weimer <fw () deneb enyo de>
Date: Tue, 24 Mar 2015 15:44:01 +0100
* Kurt Seifried:
Another example of why embargoes are a bad idea, these issues have been fixed for ages by upstream but fell through the cracks, because embargo!
There is no hard information in those bug reports. It's not clear what, precisely, they are about, and so it is impossible to tell if they actually have been fixed. I appreciate that you clean out old stuff, but doing it this way makes it seem you suddenly have developed a policy for secrecy around security issues.
https://bugzilla.redhat.com/show_bug.cgi?id=1063550
(CVE-2014-0048) Could this be a dupe of the index.docker.io registry misconfiguration that had at least one redirect to http:// (now fixed) for the actual (unverified) image data?
Current thread:
- 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Kurt Seifried (Mar 23)
- Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Florian Weimer (Mar 24)
- Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Kurt Seifried (Mar 24)
- Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Eric Windisch (Mar 24)
- Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Trevor Jay (Mar 24)
- Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Florian Weimer (Mar 31)
- Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Kurt Seifried (Mar 24)
- Re: 2 moderate (borderline low) docker flaws fixed in >=1.5 and possibly earlier Florian Weimer (Mar 24)