| 1 |
On 03/03/2016 23:00, Grant Edwards wrote: |
| 2 |
> I'm sure I'm just being stupid, but I don't understand the lists of |
| 3 |
> affected and unaffected version numbers in Gentoo security advisories. |
| 4 |
> |
| 5 |
> For example: |
| 6 |
> |
| 7 |
> Package dev-libs/openssl on all architectures |
| 8 |
> Affected versions < 1.0.2f |
| 9 |
> |
| 10 |
> Unaffected versions >= 1.0.2f, revision >= 1.0.1r, revision >= 1.0.1s, |
| 11 |
> revision >= 1.0.1t, revision >= 0.9.8z_p8, |
| 12 |
> revision >= 0.9.8z_p9, revision >= 0.9.8z_p10, |
| 13 |
> revision >= 0.9.8z_p11, revision >= 0.9.8z_p12, |
| 14 |
> revision >= 0.9.8z_p13, revision >= 0.9.8z_p14, |
| 15 |
> revision >= 0.9.8z_p15 |
| 16 |
> |
| 17 |
> If it's true that versions >= 0.9.8z_p8 are unaffected, |
| 18 |
> why is there a need to list that versions >= 0.9.8z_p[9-15] are |
| 19 |
> unaffected? Are <> relationships betwen version numbers within the |
| 20 |
> 0.9.8z_pNNN seriels not transitive? |
| 21 |
> |
| 22 |
|
| 23 |
|
| 24 |
Easiest possible answer, and highly likely to be the correct one: |
| 25 |
|
| 26 |
Someone rushed out a notice. They made typos. Or the extract script has |
| 27 |
bad logic and printed the wrong compare symbols. Or the transitiveness |
| 28 |
of the subject matter simply never occurred to the author. |
| 29 |
|
| 30 |
No need to get all technical on this. Yes strictly speaking it is |
| 31 |
incorrect. But if you've been following DROWN the intent is crystal |
| 32 |
clear and you can put it down to yet another bug. |
| 33 |
|
| 34 |
Pity we can't take the same attitude with what openssl upstream did with |
| 35 |
1.0.2g |
| 36 |
|
| 37 |
|
| 38 |
-- |
| 39 |
Alan McKinnon |
| 40 |
alan.mckinnon@×××××.com |
Archives