Bug#767227: [oss-security] Re: CVE request: lsyncd command injection

2014-12-29 Thread Jan Dittberner
On Mon, Dec 29, 2014 at 02:34:40AM +0100, Moritz Mühlenhoff wrote: > On Wed, Nov 26, 2014 at 12:18:13AM +0100, Ángel González wrote: > > On 20-11-2014 Mitre wrote: > > > > There is a command injection flaw in lsyncd, a file change monitoring > > > > and synchronization daemon: > > > > > > > > http

Bug#767227: [oss-security] Re: CVE request: lsyncd command injection

2014-12-28 Thread Moritz Mühlenhoff
On Wed, Nov 26, 2014 at 12:18:13AM +0100, Ángel González wrote: > On 20-11-2014 Mitre wrote: > > > There is a command injection flaw in lsyncd, a file change monitoring > > > and synchronization daemon: > > > > > > https://github.com/axkibe/lsyncd/issues/220 > > > > > > https://github.com/creshal

Bug#767227: [oss-security] Re: CVE request: lsyncd command injection

2014-11-26 Thread Sven Schwedas
On 2014-11-26 00:18, Ángel González wrote: > On 20-11-2014 Mitre wrote: >>> There is a command injection flaw in lsyncd, a file change monitoring >>> and synchronization daemon: >>> >>> https://github.com/axkibe/lsyncd/issues/220 >>> >>> https://github.com/creshal/lsyncd/commit/18f02ad013b41a727539

Bug#767227: [oss-security] Re: CVE request: lsyncd command injection

2014-11-25 Thread Ángel González
On 20-11-2014 Mitre wrote: > > There is a command injection flaw in lsyncd, a file change monitoring > > and synchronization daemon: > > > > https://github.com/axkibe/lsyncd/issues/220 > > > > https://github.com/creshal/lsyncd/commit/18f02ad013b41a72753912155ae2ba72f2a53e52 > > > > https://bugs.

Bug#767227: [oss-security] Re: CVE request: lsyncd command injection

2014-11-21 Thread Michael Samuel
On 20 November 2014 17:55, wrote: > Use CVE-2014-8990. The scope of this CVE ID includes both: > 2. denial of service scenarios in which a user with write access > to a local directory uses special characters to make > synchronization fail (might have security relevance in some >