On Tue, 2020-11-24 at 17:36 +0300, Dmitry V. Levin wrote:
On Tue, Nov 24, 2020 at 02:51:41PM +0100, Tomas Mraz wrote:
On Tue, 2020-11-24 at 14:49 +0100, Tomas Mraz wrote:
On Mon, 2020-11-23 at 16:19 +0300, Dmitry V. Levin wrote:
On Mon, Nov 23, 2020 at 01:09:33PM +0100, Tomas Mraz wrote:
On Mon, 2020-11-23 at 14:04 +0300, Dmitry V. Levin wrote:
On Mon, Nov 23, 2020 at 11:53:56AM +0100, Tomas Mraz wrote:
> IMO if we regard this as security issue we should get CVE > number. > Only > in case we do not regard it as such - i.e. we think it is > just > plain > regression bug we should not get CVE. > > My personal opinion is that this is a security issue > although > low > or > medium one only. But I can be persuaded otherwise.
This regression in pam_unix may have security implications, so let's treat it this way.
To make a release, we need an updated NEWS file, and it seems appropriate to mention the CVE number there.
Should I try to get the CVE number from our Product Security team?
Yes, please try.
We have allocated CVE-2020-27780 for this issue. I'll merge the PR after amending the commit with the CVE number.
Heh, I forgot I've already merged it. I'll add a NEWS entry.
Great. Are we ready for the release now?
I think we should release ASAP so we do not introduce another regression by merging further stuff. :D