Re: eglibc update for GHOST CVE-2015-0235

2015-01-28 Thread Thorsten Alteholz
Hi Thijs, On Wed, 28 Jan 2015, Raphael Hertzog wrote: Nor do I have a good understanding of who is working on LTS. People are hired by the hour, so if I send something to someone personally now it may just be that they're not working on LTS this week. hmm, not working on LTS doesn't mean that

Re: eglibc update for GHOST CVE-2015-0235

2015-01-28 Thread Raphael Hertzog
Hi Thijs, On Wed, 28 Jan 2015, Thijs Kinkhorst wrote: > It seems at least from my perspective that the LTS team is a loosely > defined consortium of individuals which makes sharing the embargoed > information problematic. If I have an embargoed issue I think there's > usually no problem sharing th

Re: eglibc update for GHOST CVE-2015-0235

2015-01-28 Thread Holger Levsen
Hi, On Mittwoch, 28. Januar 2015, Thijs Kinkhorst wrote: > It seems at least from my perspective that the LTS team is a loosely > defined consortium of individuals which makes sharing the embargoed > information problematic. If I have an embargoed issue I think there's > usually no problem sharing

Re: eglibc update for GHOST CVE-2015-0235

2015-01-28 Thread Thijs Kinkhorst
On Wed, January 28, 2015 11:29, Lucas Nussbaum wrote: > Yes, I was wondering how we could improve on the current status for the > handling of medium/high-severity issues, and I'm interested in the > Debian security team's opinion about that. > > Should the Debian LTS team apply to join the linux-di

Re: eglibc update for GHOST CVE-2015-0235

2015-01-28 Thread Lucas Nussbaum
Hi, On 28/01/15 at 11:13 +0100, Holger Levsen wrote: > Hi, > > On Mittwoch, 28. Januar 2015, Raphael Hertzog wrote: > > Of course we do! That said the current LTS team doesn't have access > > to embargoed information and thus nobody prepared the update in advance. > > Lucas now contacted me abou

Re: eglibc update for GHOST CVE-2015-0235

2015-01-28 Thread Holger Levsen
Hi, On Mittwoch, 28. Januar 2015, Raphael Hertzog wrote: > Of course we do! That said the current LTS team doesn't have access > to embargoed information and thus nobody prepared the update in advance. Lucas now contacted me about this and he said he would try to start with some informal discuss

Re: eglibc update for GHOST CVE-2015-0235

2015-01-27 Thread Raphael Hertzog
Hello Sébastien, On Tue, 27 Jan 2015, Sebastien Dupas wrote: > Due to the announce of the GHOST security flaw, we need to update our > systems using Debian squeeze. > > Do you plan to release the security update of the eglibc and related > packages? Of course we do! That said the current LTS tea

Re: eglibc update for GHOST CVE-2015-0235

2015-01-27 Thread Ben Hutchings
On Wed, 2015-01-28 at 13:39 +1300, Andrew Bartlett wrote: > On Tue, 2015-01-27 at 23:47 +0100, Nicolas Chipaux wrote: > > Hello folks, > > > > For our internal use at Gandi.net, we created a source package for eglibc > > with the fix for the CVE 2015-0235 taken from the eglibc package from > > D

Re: eglibc update for GHOST CVE-2015-0235

2015-01-27 Thread Andrew Bartlett
On Tue, 2015-01-27 at 23:47 +0100, Nicolas Chipaux wrote: > Hello folks, > > For our internal use at Gandi.net, we created a source package for eglibc > with the fix for the CVE 2015-0235 taken from the eglibc package from > Debian wheezy 2.13-38+deb7u7 : any/cvs-gethostbyname.diff. In order to

Re: eglibc update for GHOST CVE-2015-0235

2015-01-27 Thread Michael Banck
On Tue, Jan 27, 2015 at 11:47:14PM +0100, Nicolas Chipaux wrote: > In order to release quickly, we disabled the test in this patch during > the build. As an aside, you should be able to skip the testsuite by setting DEB_BUILD_OPTIONS=nocheck (but it might be tricky to get into the build environmen

Re: eglibc update for GHOST CVE-2015-0235

2015-01-27 Thread Nicolas Chipaux
Hello folks, For our internal use at Gandi.net, we created a source package for eglibc with the fix for the CVE 2015-0235 taken from the eglibc package from Debian wheezy 2.13-38+deb7u7 : any/cvs-gethostbyname.diff. In order to release quickly, we disabled the test in this patch during the buil

eglibc update for GHOST CVE-2015-0235

2015-01-27 Thread Sebastien Dupas
Hello, Due to the announce of the GHOST security flaw, we need to update our systems using Debian squeeze. Do you plan to release the security update of the eglibc and related packages? Thank you. Regards. -- \o/ Sébastien Dupas G Gandi -- To UNSUBSCRIBE, email to debian-lts-requ...@l