On 10/3/14, 4:55 AM, Nathan McGarvey wrote:
> Is there any linkage between bash patches and known CVE (or any other
> database) IDs? (Source-code comment, bug-tracker, etc.)
> I understand that there is not a one<->one relationship, but for the
> bug-fixes that do pertain to one or more vulnerability entry, it may be
> beneficial to outright state "this patch is designed to fix X".
Yes, here's a list. I lose track of the CVE IDs myself.
bash43-025 CVE-2014-6271 9/24/2014
bash43-026 CVE-2014-7169 9/26/2014
bash43-027 exported function namespace change 9/27/2014
bash43-028 CVE-2014-7186/CVE-2014-7187 10/1/2014
bash43-029 CVE-2014-6277 10/2/2014
There is still one more, for CVE-2014-6278, that I have to do some minor
work on before rolling out patches.
Chet
--
``The lyf so short, the craft so long to lerne.'' - Chaucer
``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU c...@case.edu http://cnswww.cns.cwru.edu/~chet/
