[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140912140344.5864641a@redhat.com>
Date: Fri, 12 Sep 2014 14:03:44 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Sven Kieske <s.kieske@...twald.de>
Subject: Re: CVE Request: MySQL: MyISAM temporary file issue
On Fri, 12 Sep 2014 09:12:18 +0200 Sven Kieske wrote:
> Well I hope than that I can soon migrate to mariadb or postgresql.
> In other words, to a db which takes security serious and handles
> it professional, as this is clearly not professional behaviour.
I honestly fail to see MariaDB as a sliver bullet here. No doubt
MariaDB upstream is more open with respect to security issues handling
and does not seem to obfuscate security flaw details the same way MySQL
upstream does. However, I don't believe they have any better
visibility into what Oracle assigned CVEs are for. So for example, they
likely did not have a way to be sure that CVE-2014-2440 is dupe a of
CVE-2014-0001 until it was confirmed elsewhere in this thread.
At this point, it seems reasonable to assume that any Oracle assigned
CVE most likely affects matching 5.x MariaDB versions, and that it is
fixed when MariaDB is rebased to a fixed MySQL version. With 10.x being
a full fork no longer being rebased to new MySQL releases, it will
become increasingly uncertain if certain MySQL CVE is applicable to
MariaDB as well, or to know if it was addressed.
--
Tomas Hoger / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
