Bug#508031: marked as done (Tracking vulnerabilities that have already been patched in other distributions)
Your message dated Sat, 17 Jan 2015 16:03:26 +0100
with message-id <20150117150326.GA21958@pisco.westfalen.local>
and subject line closing
has caused the Debian Bug report #508031,
regarding Tracking vulnerabilities that have already been patched in other distributions
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)
--
508031: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=508031
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
- To: submit@bugs.debian.org
- Subject: Tracking vulnerabilities that have already been patched in other distributions
- From: "Michael Gilbert" <michael.s.gilbert@gmail.com>
- Date: Sat, 6 Dec 2008 23:40:27 -0500
- Message-id: <8e2a98be0812062040i10bab143wff3424c325591bca@mail.gmail.com>
Package: security-tracker
Severity: important
Oftentimes, a fix gets released for other distributions, and then it
takes weeks or months for Debian to apply the same fix. I wonder if
this is primarily a communication issue and whether including this
type of information in the tracker would help reduce this lag. The
intent would be to increase the security team/package maintainers
awareness of existing patches.
Some current examples (not a comprehensive list, I only spent 5
minutes on this):
CVE-2008-4552: fixed in ubuntu [1]
CVE-2008-2379: fixed in fedora [2]
I'm considering the severity important since leaving user's systems
vulnerable while a fix exists is a very bad thing.
If I get the time, I may look at trying to add this myself, but no
guarantees. So if anyone else is interested in the problem, go for
it.
Mike
[1] http://www.ubuntu.com/usn/USN-687-1
[2] https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00232.html
--- End Message ---
--- Begin Message ---
- To: Nico Golde <nion@debian.org>
- Cc: 508031-done@bugs.debian.org
- Subject: closing
- From: Moritz Mühlenhoff <jmm@inutil.org>
- Date: Sat, 17 Jan 2015 16:03:26 +0100
- Message-id: <20150117150326.GA21958@pisco.westfalen.local>
- In-reply-to: <20081208091009.GL6996@ngolde.de>
- References: <8e2a98be0812062040i10bab143wff3424c325591bca@mail.gmail.com> <20081207142111.GB6996@ngolde.de> <2d460de70812070710h8fbf4eay87e676c8b6b625d0@mail.gmail.com> <878wqsf1lb.fsf@mid.deneb.enyo.de> <8e2a98be0812071707w59668e6ao9649ce2dcf2902b7@mail.gmail.com> <20081208083214.GI6996@ngolde.de> <2d460de70812080048y79d63910qebed472f3e229e21@mail.gmail.com> <20081208091009.GL6996@ngolde.de>
We've discussed this during the security team meeting and decided to
close the bug: There are no other distributions which publish parseable
data and we already have links to other bug trackers.
--- End Message ---
Reply to: