Re: CVE-2017-3590 in mysql-connector-python

To: debian-lts@lists.debian.org
Subject: Re: CVE-2017-3590 in mysql-connector-python
From: Markus Koschany <apo@debian.org>
Date: Thu, 10 Aug 2017 12:02:58 -0400
Message-id: <[🔎] a2e7e925-2d0e-6642-b74e-a73b03cdad80@debian.org>
In-reply-to: <[🔎] 20170810152904.j77i6aqpkzgmgmbh@hle-laptop.local>
References: <[🔎] 20170810152904.j77i6aqpkzgmgmbh@hle-laptop.local>

On 10/08/17 11:29, Hugo Lefeuvre wrote:

Hi,

mysql-connector-python is affected by CVE-2017-3590.

Since we cannot extract the fix from the upstream patch, the only way to solve
the issue is to backport 2.6.1-1 to wheezy. However this issue is no-dsa
in Jessie, which has 1.2.3-2.

If I backport 2.6.1 to wheezy, wheezy will have a newer version than jessie.

Should I mark the issue no-dsa in this case ?

It appears that CVE-2017-3590 can only be exploited locally. We couldalso postpone the update and wait for more important issues and fix thisissue later.


Regards,

Markus

Reply to:

Follow-Ups:
- Re: CVE-2017-3590 in mysql-connector-python
  - From: Moritz Mühlenhoff <jmm@inutil.org>

References:
- CVE-2017-3590 in mysql-connector-python
  - From: Hugo Lefeuvre <hle@debian.org>

Prev by Date: Re: CVE-2017-3590 in mysql-connector-python
Next by Date: Re: CVE-2017-3590 in mysql-connector-python
Previous by thread: Re: CVE-2017-3590 in mysql-connector-python
Next by thread: Re: CVE-2017-3590 in mysql-connector-python
Index(es):
- Date
- Thread