openstack team mailing list archive
Mailing list archive
Re: [OSSA 2013-013] Keystone client local information disclosure (CVE-2013-2013)
What if we were to always do a release after a security advisory?
On 4 Jun 2013 06:25, "Jeremy Stanley" <fungi@xxxxxxxxxxx> wrote:
> On 2013-06-03 10:51:19 -0700 (-0700), Lloyd Dewolf wrote:
> > Interestingly, the OSSA 2013-014 notice did include
> > "python-keystoneclient fix (will be included in upcoming 0.2.4
> > release)".
> I'm going to chalk that up to Thierry knowing the version number at
> that point, since the OSSA 2013-014 fix is what got tagged with
> 0.2.4 the next morning. On the other hand the -013 fix was a
> lower-priority feature enhancement and I didn't want to rely on a
> versioning guess a week ahead. Client releases are handled a bit
> more independently compared to OpenStack server components (where we
> can predict release milestone dates fairly accurately).
> As a general rule I'm going to try to include the release version
> numbers in advance when I can do so safely, and otherwise rely on
> subsequent release announcements.
> Jeremy Stanley
> Mailing list: https://launchpad.net/~openstack
> Post to : openstack@xxxxxxxxxxxxxxxxxxx
> Unsubscribe : https://launchpad.net/~openstack
> More help : https://help.launchpad.net/ListHelp