Gerd, As a new EDK2 developer, I'm working through getting the patches up to EDK2 but I have to follow the EDK2 patch process which is not the fastest thing to follow and also not my day job. If you want to see where I am you can look at the CI Pipeline. The patches were reviewed during the GHSA process by the Infosec group and have been shipping in devices already. I'm hoping to have the patches on the mailing list by EOD. This is a great topic for ways we can speed up the review process and contribution process - particularly for security patches and it would be great to get more people actively involved in reviews and testing during creation and delivery of patches.
- Doug -----Original Message----- From: Gerd Hoffmann <kra...@redhat.com> Sent: Tuesday, January 23, 2024 8:36 AM To: devel@edk2.groups.io; Doug Flick <dougfl...@microsoft.com> Cc: Jon Maloy <jma...@redhat.com> Subject: [EXTERNAL] pixiefail [You don't often get email from kra...@redhat.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ] Hi, What is the state of affairs wrt. the pixiefail vulnerabilities? The advisory is published (https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h), it says the plan is to have the fixes included in the next (Feb 2024) stable tag. I see bugzilla has patches attached, most of them written by Doug Flick. There is not that much time left until code freeze starts. Shouldn't we get the ball rolling to get the patches reviewed and merged? Given that the pixiefail details where published last week it should be ok to simply send the patches to the devel list for review. thanks & take care, Gerd -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#114228): https://edk2.groups.io/g/devel/message/114228 Mute This Topic: https://groups.io/mt/103913088/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
