Hi, * Dominic Hargreaves <[EMAIL PROTECTED]> [2008-11-08 15:42]: > On Wed, Oct 22, 2008 at 12:21:47PM -0700, Chris Hall wrote: > > That's correct, Dominic. Our Japanese subsidiary released 4.22 and we > > were due to release it shortly afterwards. Unfortunately, in the time > > between their release and ours a further security issue was > > discovered, necessitating a delay in our release of 4.22, and in > > fact, requiring that we skip 4.22 and go directly to 4.23, which both > > SAKK and SAUS will be releasing concurrently either later this week > > or early next. > > Is there any further news of this? I'm particularly interested, since > our (Debian) release is hopefully very near now, to get any > security-relevant changes in. One of my colleages from Debian has > extracted the XSS-related issues from MTOS-4.22-ja[1] but I would be > more confident in applying this if it came as patches from the same > source as the movabletype.org releases I'm currently > packaging. [...]
Did you get any response on this? I suggest that we upload the fix that we now have if we don't get any news in the next days, the release is knocking on the door... Cheers Nico -- Nico Golde - http://www.ngolde.de - [EMAIL PROTECTED] - GPG: 0x73647CFF For security reasons, all text in this mail is double-rot13 encrypted.
pgpNwRtlNP0hX.pgp
Description: PGP signature
