[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAJ3HoZ3XNCHL+Q_LVyezVB7Lk+AGNcKT-fVt3UWzmO8mCMVqbg@mail.gmail.com>
Date: Tue, 4 Jun 2013 07:11:40 +1200
From: Robert Collins <robertc@...ertcollins.net>
To: Jeremy Stanley <fungi@...goth.org>
Cc: openstack@...ts.launchpad.net, oss-security@...ts.openwall.com
Subject: Re: [Openstack] [OSSA 2013-013] Keystone client local information
disclosure (CVE-2013-2013)
What if we were to always do a release after a security advisory?
On 4 Jun 2013 06:25, "Jeremy Stanley" <fungi@...goth.org> wrote:
> On 2013-06-03 10:51:19 -0700 (-0700), Lloyd Dewolf wrote:
> [...]
> > Interestingly, the OSSA 2013-014 notice did include
> > "python-keystoneclient fix (will be included in upcoming 0.2.4
> > release)".
>
> I'm going to chalk that up to Thierry knowing the version number at
> that point, since the OSSA 2013-014 fix is what got tagged with
> 0.2.4 the next morning. On the other hand the -013 fix was a
> lower-priority feature enhancement and I didn't want to rely on a
> versioning guess a week ahead. Client releases are handled a bit
> more independently compared to OpenStack server components (where we
> can predict release milestone dates fairly accurately).
>
> As a general rule I'm going to try to include the release version
> numbers in advance when I can do so safely, and otherwise rely on
> subsequent release announcements.
> --
> Jeremy Stanley
>
> _______________________________________________
> Mailing list: https://launchpad.net/~openstack
> Post to : openstack@...ts.launchpad.net
> Unsubscribe : https://launchpad.net/~openstack
> More help : https://help.launchpad.net/ListHelp
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
