Re: Incorrect information in security tracker regarding the mahara package
On Fri, 23 Oct 2009 11:36:29 +1300 Francois Marier wrote:
> (please CC me on replies, I'm not on this list)
>
> Hi,
>
> I just want to report that this issue:
>
> http://security-tracker.debian.org/tracker/CVE-2009-2171
>
> does not apply to the 1.0 series of Mahara, as mentioned on the upstream
> advisory:
>
> http://mahara.org/interaction/forum/topic.php?id=753
>
> So the lenny version of Mahara, 1.0.4-4+lenny3, should not be marked as
> vulnerable.
did you manually check the code? we have to review the source code
directly because advisory texts are often inexact, incomplete, or
incorrect.
if you are able to help, that would be great.
mike
Reply to: