Re: Critical: ssh-nonfree IS exploited
On Sun, Nov 11, 2001 at 12:43:11PM -0500, Stuart Krivis wrote:
> But, it's been pretty obvious that non-free is provided for the user's
> convenience or to provide stepping stones to a completely free system
> over time. That leaves it up to the maintainer of an individual non-free
> package to make sure that the package won't allow the entire distro to
> be compromised. If the maintainer can't or won't fix it or provide bold
> warnings upon installation, then the package needs to be cut loose.
The maintainer *has* fixed it (for i386, at any rate) in
proposed-updates. The issue is that it needs to be available from
security.d.o and an advisory released, and the set of people with access
to do that is strictly limited.
(Not sure the relevant people read -user, but anyway ...)
--
Colin Watson [cjwatson@flatline.org.uk]
Reply to: