Debian
fetchmail package

  1. Bug #24758
  2. Comment #20

Comment 20 for bug 24758

Revision history for this message
Debian Bug Importer (debzilla) wrote :

Message-ID: <email address hidden>
Date: Tue, 15 Nov 2005 09:17:26 +0100
From: Loic Minier <email address hidden>
To: Nico Golde <email address hidden>
Cc: <email address hidden>, <email address hidden>
Subject: Re: Bug#323027: IMPORTANT: fetchmail regression in 6.2.5-12sarge1

On Mon, Nov 14, 2005, Nico Golde wrote:
> What do you think exactly? The changes from 6.2.5.2 fixed=20
> CVE-2005-2335, Steve Kemp prepared the fixed package.
> But you are right it seems that some things are broken, for=20
> example the apop support.

 I think the changes in 6.2.5.2 included a fix for CVE-2005-2335, and
 only this fix should have been uploaded.

 Now that sarge2 is already on the tracks, I propose to prepare a sarge3
 with everything from sarge1 reverted and fetchmail_CAN-2005-2335.diff
 applied instead (along with patch.CVE-2005-3088.fetchmail of course).

 Security team, please ack the proposed changes.

 Alternatively, we could live with the regression and I could prepare a
 stable upload with all fixes from 6.2.5.4.

   Bye,
--=20
Lo=EFc Minier <email address hidden>