Hi, I've been working on mapping CVE fixes in 10.6.x for the purpose of backporting the fixes recently. These two in 10.6.28 have me a little suspicious: CVE-2026-60585 CVE-2026-60184
Based on the CVE report, these (and some others listed as fixed in 10.6.28) are in the replication subsystem. I mapped the specifics, but these two don't quite tally with what is in the report. Then I compared with 10.11.19 release notes which list the exact same CVEs fixed as 10.6.28. But looking at the tickets and commits, there's a whole additional patch set of about 11 tickets and 12 commits with fixes to what look like bugs that likely are security fixes: I'm not going to list them here since they are security related, but is anyone here close to the release and testing process for verifying that CVEs are testing as fixed for publishing in the release notes? The reason I'm asking is because I suspect that those two CVEs I mentioned above may be fixed in 10.11.19 as listed in the release notes for that but not fixed in 10.6.28 despite being listed there. I'm working on backporting that 12-patch set to my private 10.6.x post-EOL maintenance branch, but I'd be happy to sync up with someone closer to the validation process off-list to verify (or disprove) my suspicions.. -- Gordan Bobic Database Specialist, Shattered Silicon Ltd. https://shatteredsilicon.net Follow us: LinkedIn: https://www.linkedin.com/company/shatteredsilicon X: https://x.com/ssiliconbg _______________________________________________ discuss mailing list -- [email protected] To unsubscribe send an email to [email protected]
