wordpress: Several security vulnerabilities fixed in 3.4.1 CVE-2012-3383, CVE-2012-3384, CVE-2012-3385

Debian Bug report logs - #680721
wordpress: Several security vulnerabilities fixed in 3.4.1 CVE-2012-3383, CVE-2012-3384, CVE-2012-3385

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Henri Salo <henri@nerv.fi>

To: submit@bugs.debian.org

Subject: wordpress: Several security vulnerabilities fixed in 3.4.1 CVE-2012-3383, CVE-2012-3384, CVE-2012-3385

Date: Sun, 8 Jul 2012 11:04:45 +0300

Package: wordpress
Version: 3.3.2+dfsg-1~squeeze1
Severity: important
Tags: security

Several security vulnerabilities has been fixed in WordPress version 3.4.1 [1]. CVE-identifiers assigned in oss-security mailing list [2][3]. These issues should be patched as soon as possible. Please ask in case you need my help.

1: http://codex.wordpress.org/Version_3.4.1
2: http://www.openwall.com/lists/oss-security/2012/07/02/1
3: http://www.openwall.com/lists/oss-security/2012/07/08/1

- Henri Salo

Message #10 received at 680721@bugs.debian.org (full text, mbox, reply):

From: Raphael Hertzog <hertzog@debian.org>

To: Henri Salo <henri@nerv.fi>, 680721@bugs.debian.org

Subject: Re: Bug#680721: wordpress: Several security vulnerabilities fixed in 3.4.1 CVE-2012-3383, CVE-2012-3384, CVE-2012-3385

Date: Sun, 8 Jul 2012 21:49:57 +0200

Hello,

On Sun, 08 Jul 2012, Henri Salo wrote:
> Package: wordpress
> Version: 3.3.2+dfsg-1~squeeze1
> Severity: important
> Tags: security
> 
> Several security vulnerabilities has been fixed in WordPress version
> 3.4.1 [1]. CVE-identifiers assigned in oss-security mailing list [2][3].
> These issues should be patched as soon as possible. Please ask in case
> you need my help.

Yes, I'll gladly accept help.

Are you able to extract and backport the relevant patches?

If yes, we definitely want you as co-maintainer. :-)

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Get the Debian Administrator's Handbook:
→ http://debian-handbook.info/get/

Message #17 received at 680721@bugs.debian.org (full text, mbox, reply):

From: Hor Jiun Shyong <jiunshyong@gmail.com>

To: Raphael Hertzog <hertzog@debian.org>, 680721@bugs.debian.org

Cc: Henri Salo <henri@nerv.fi>

Subject: Re: Bug#680721: wordpress: Several security vulnerabilities fixed in 3.4.1 CVE-2012-3383, CVE-2012-3384, CVE-2012-3385

Date: Mon, 09 Jul 2012 12:01:20 +0800

Hi,

I would like to offer my help for the wordpress package too.   Thanks.

-
Regards,
Hor Jiun Shyong 何俊雄

Blog: jiunshyong.dyndns.org
twitter.com/jiunshyong
facebook.com/jiunshyong

I'm an FSF member -- Help us support software freedom! http://www.fsf.org/jf?referrer=2442

Knowing is not enough, we must apply. Willing is not enough, we must do - Bruce Lee.




On 07/09/2012 03:49 AM, Raphael Hertzog wrote:
> Hello,
>
> On Sun, 08 Jul 2012, Henri Salo wrote:
>> Package: wordpress
>> Version: 3.3.2+dfsg-1~squeeze1
>> Severity: important
>> Tags: security
>>
>> Several security vulnerabilities has been fixed in WordPress version
>> 3.4.1 [1]. CVE-identifiers assigned in oss-security mailing list [2][3].
>> These issues should be patched as soon as possible. Please ask in case
>> you need my help.
> Yes, I'll gladly accept help.
>
> Are you able to extract and backport the relevant patches?
>
> If yes, we definitely want you as co-maintainer. :-)
>
> Cheers,


-

Message #22 received at 680721@bugs.debian.org (full text, mbox, reply):

From: Raphael Hertzog <hertzog@debian.org>

To: Henri Salo <henri@nerv.fi>, Hor Jiun Shyong <jiunshyong@gmail.com>

Cc: 680721@bugs.debian.org

Subject: Re: Bug#680721: wordpress: Several security vulnerabilities fixed in 3.4.1 CVE-2012-3383, CVE-2012-3384, CVE-2012-3385

Date: Mon, 9 Jul 2012 08:06:26 +0200

Hi,

On Sun, 08 Jul 2012, Henri Salo wrote:
> On Sun, Jul 08, 2012 at 09:49:57PM +0200, Raphael Hertzog wrote:
> > Are you able to extract and backport the relevant patches?
> 
> I haven't done this before. What does this exactly mean? I am not a Debian developer yet.

What kind of help had you in mind?

In any case, the above text means:
1/ finding out the upstream commit that fixes the security issue
2/ trying to apply it to the version that we have in Debian stable
3/ adapting it if required (because the code evolved between
3.3.2 and 3.4.1 and the patch might not apply any more)

There's no need to be a Debian developer to do this. Submitting patches by
mail here is perfectly OK.

Going further, if you help on a regular basis, I can get you added to the
Alioth project so that you can commit your work directly.

On Mon, 09 Jul 2012, Hor Jiun Shyong wrote:
> I would like to offer my help for the wordpress package too.   Thanks.

Great!

Do you need direction to get started or do you already know how you can
help?

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Get the Debian Administrator's Handbook:
→ http://debian-handbook.info/get/

Message #27 received at 680721@bugs.debian.org (full text, mbox, reply):

From: Hor Jiun Shyong <jiunshyong@gmail.com>

To: Raphael Hertzog <hertzog@debian.org>

Cc: Henri Salo <henri@nerv.fi>, 680721@bugs.debian.org

Subject: Re: Bug#680721: wordpress: Several security vulnerabilities fixed in 3.4.1 CVE-2012-3383, CVE-2012-3384, CVE-2012-3385

Date: Tue, 10 Jul 2012 15:30:15 +0800

On 07/09/2012 02:06 PM, Raphael Hertzog wrote:
> Great!
>
> Do you need direction to get started or do you already know how you can
> help?
>
> Cheers,

Yes , I would need direction on how to get started. Thanks.


Regards,
Hor Jiun Shyong 何俊雄

Blog: jiunshyong.dyndns.org
twitter.com/jiunshyong
facebook.com/jiunshyong

I'm an FSF member -- Help us support software freedom! http://www.fsf.org/jf?referrer=2442

Knowing is not enough, we must apply. Willing is not enough, we must
do - Bruce Lee.

Message #32 received at 680721@bugs.debian.org (full text, mbox, reply):

From: Raphael Hertzog <hertzog@debian.org>

To: 680721@bugs.debian.org

Cc: Henri Salo <henri@nerv.fi>

Subject: Re: Bug#680721: wordpress: Several security vulnerabilities fixed in 3.4.1 CVE-2012-3383, CVE-2012-3384, CVE-2012-3385

Date: Tue, 10 Jul 2012 09:08:23 +0200

On Tue, 10 Jul 2012, Hor Jiun Shyong wrote:
> 
> On 07/09/2012 02:06 PM, Raphael Hertzog wrote:
> >Great!
> >
> >Do you need direction to get started or do you already know how you can
> >help?
> >
> >Cheers,
> 
> Yes , I would need direction on how to get started. Thanks.

FTR, I had another mail of Hor where I suggested those activities:

There are many ways to help:
- bug triage and forwarding bugs upstream
- submitting upstream some of the patches in debian/patches/
  which haven't been submitted yet
- trying to backporting security fixes to the version in stable
- developing a tool to automatically package wordpress plugins
  and themes

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Get the Debian Administrator's Handbook:
→ http://debian-handbook.info/get/

Message #39 received at 680721-done@bugs.debian.org (full text, mbox, reply):

From: Raphael Hertzog <hertzog@debian.org>

To: 680721-done@bugs.debian.org

Subject: Fixed in newer upstream release

Date: Tue, 26 Feb 2013 15:47:03 +0100

Versions: 3.4.1+dfsg-1

Hello,

this has been fixed in version 3.4.1 upstream. Closing properly with
version tracking.

Cheers,
-- 
Raphaël Hertzog ◈ Debian Developer

Get the Debian Administrator's Handbook:
→ http://debian-handbook.info/get/

Send a report that this bug log contains spam.