Conversation

Notices

1. Embed this notice
   Jonathan Wright :almalinux: (jonathanspw@fosstodon.org)'s status on Friday, 21-Jul-2023 23:17:17 JST Jonathan Wright :almalinux:

   Earlier today at #almalinux we patched CVE-2023-38403 in iperf3 and released it prior to anyone else in the EL-ecosystem. We promptly submitted PRs with #centos and #fedora.

   A lot was learned during this process so we can nail down the processes of doing our own patches while contributing upstream and ultimately deliver on our promises from https://almalinux.org/blog/future-of-almalinux/

   #rhel #redhat

   • Embed this notice
     Jonathan Wright :almalinux: (jonathanspw@fosstodon.org)'s status on Friday, 21-Jul-2023 23:17:14 JST Jonathan Wright :almalinux:

     in reply to

     • T Strömberg 🚲🌳🛵

     @thomrstrom I became aware of the CVE yesterday when a ticket was opened about it in Fedora. I'm a maintainer of the Fedora package so I immediately checked if AlmaLinux/RHEL were vulnerable too and proceeded from there.

     My PR has been rejected by RH and I'm not terribly sure why. At least I tried, I guess, and since AlmaLinux isn't targeting 1:1 we have the patch and RHEL won't I suppose.

     https://gitlab.com/redhat/centos-stream/rpms/iperf3/-/merge_requests/5#note_1476778724

   • Embed this notice
     T Strömberg 🚲🌳🛵 (thomrstrom@triangletoot.party)'s status on Friday, 21-Jul-2023 23:17:16 JST T Strömberg 🚲🌳🛵

     in reply to

     @jonathanspw

     I'm grateful to hear that y'all upstreamed patches to the other distros - that's true open-source sportsmanship.

     Out of curiosity I checked the patch timeline elsewhere:

     - 2023-07-07: iperf security advisory w/ patch
     - 2023-07-09: Alpine, Wolfi, Chainguard Images
     - 2023-07-10: ArchLinux
     - 2023-07-17: CVE published
     - 2023-07-17: Debian stable
     - Not yet: Oracle, RH

     Unsurprisingly, the timeline follows the continuum of how each distro treats security vs stability.

     Haelwenn /элвэн/ :triskell: likes this.
     Alex Gleason repeated this.