glusterfs: cve-2012-5635

Debian Bug report logs - #704944
glusterfs: cve-2012-5635

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <mgilbert@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: glusterfs: cve-2012-5635

Date: Sun, 7 Apr 2013 22:02:30 -0400

package: src:glusterfs
severity: important
tag: security

Hi,

redhat published some advisories for glusterfs.  After spending a bit
of time, I wasn't track down patches, but the following link has
information:
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5635

The redhat advisory indicates that the fixes are included in 3.3.0:
https://rhn.redhat.com/errata/RHSA-2013-0691.html

Best wishes,
Mike

Message #10 received at 704944-done@bugs.debian.org (full text, mbox, reply):

From: Patrick Matthäi <pmatthaei@debian.org>

To: Michael Gilbert <mgilbert@debian.org>, 704944-done@bugs.debian.org

Subject: Re: Bug#704944: glusterfs: cve-2012-5635

Date: Mon, 08 Apr 2013 09:28:34 +0200

Am 08.04.2013 04:02, schrieb Michael Gilbert:
> package: src:glusterfs
> severity: important
> tag: security
>
> Hi,
>
> redhat published some advisories for glusterfs.  After spending a bit
> of time, I wasn't track down patches, but the following link has
> information:
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5635
>
> The redhat advisory indicates that the fixes are included in 3.3.0:
> https://rhn.redhat.com/errata/RHSA-2013-0691.html
>
> Best wishes,
> Mike
>

See:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698502


-- 
/*
Mit freundlichem Gruß / With kind regards,
 Patrick Matthäi
 GNU/Linux Debian Developer

  Blog: http://www.linux-dev.org/
E-Mail: pmatthaei@debian.org
        patrick@linux-dev.org
*/

Message #15 received at 704944@bugs.debian.org (full text, mbox, reply):

From: Michael Gilbert <mgilbert@debian.org>

To: pmatthaei@debian.org

Cc: 704944@bugs.debian.org

Subject: Re: Bug#704944: glusterfs: cve-2012-5635

Date: Mon, 8 Apr 2013 19:12:13 -0400

On Mon, Apr 8, 2013 at 3:28 AM, Patrick Matthäi wrote:
> Am 08.04.2013 04:02, schrieb Michael Gilbert:
>>
>> package: src:glusterfs
>> severity: important
>> tag: security
>>
>> Hi,
>>
>> redhat published some advisories for glusterfs.  After spending a bit
>> of time, I wasn't track down patches, but the following link has
>> information:
>> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5635
>>
>> The redhat advisory indicates that the fixes are included in 3.3.0:
>> https://rhn.redhat.com/errata/RHSA-2013-0691.html
>>
>> Best wishes,
>> Mike
>>
>
> See:
> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698502

So, because it isn't clear to me, do your patches also address the
remaining issues as reported by Kurt Seifried as stated in the redhat
bug [0], which have the different id CVE-2012-5635 or do they only
address CVE-2012-4417?

Best wishes,
Mike

[0] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5635

Message #20 received at 704944@bugs.debian.org (full text, mbox, reply):

From: Patrick Matthäi <pmatthaei@debian.org>

To: Michael Gilbert <mgilbert@debian.org>, 704944@bugs.debian.org, Louis Zuckerman <me@louiszuckerman.com>

Subject: Re: Bug#704944: glusterfs: cve-2012-5635

Date: Wed, 10 Apr 2013 20:21:18 +0200

[Message part 1 (text/plain, inline)]

Am 09.04.2013 01:12, schrieb Michael Gilbert:
> On Mon, Apr 8, 2013 at 3:28 AM, Patrick Matthäi wrote:
>> Am 08.04.2013 04:02, schrieb Michael Gilbert:
>>>
>>> package: src:glusterfs
>>> severity: important
>>> tag: security
>>>
>>> Hi,
>>>
>>> redhat published some advisories for glusterfs.  After spending a bit
>>> of time, I wasn't track down patches, but the following link has
>>> information:
>>> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5635
>>>
>>> The redhat advisory indicates that the fixes are included in 3.3.0:
>>> https://rhn.redhat.com/errata/RHSA-2013-0691.html
>>>
>>> Best wishes,
>>> Mike
>>>
>>
>> See:
>> http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=698502
> 
> So, because it isn't clear to me, do your patches also address the
> remaining issues as reported by Kurt Seifried as stated in the redhat
> bug [0], which have the different id CVE-2012-5635 or do they only
> address CVE-2012-4417?
> 
> Best wishes,
> Mike
> 
> [0] https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-5635

Good question.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5635 speaks about
the Red Hat Storage Management system, which is a product using glusterfs.
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4417 is the same
vuln. but writing about glusterfs and Red Hat Storage.

So (also if CVE-2012-5635 states: different vulnerabilities than
CVE-2012-4417) it has got the same source, just used in two different
products (so on the same fix for both CVEs)?


Louis do you have got an idea?

-- 
/*
Mit freundlichem Gruß / With kind regards,
 Patrick Matthäi
 GNU/Linux Debian Developer

  Blog: http://www.linux-dev.org/
E-Mail: pmatthaei@debian.org
        patrick@linux-dev.org
*/

[signature.asc (application/pgp-signature, attachment)]

Send a report that this bug log contains spam.