I wrote: |This release fixes an at least theoretical security vulnerability |of the privilege-separated child, which does not strip path |separators from arguments.
This has been assigned CVE-2017-5899. Unfortunately i have overreacted, even if taking into account that the first message of the reporter included discovery: 26/01/2016 disclosure: 26/01/2016 on [email protected] disclosure: 27/01/2016 contacted [email protected] which mysteriously was missing from the message that has been sent to oss-security@. Apologies nonetheless. I will try not to make this happen once again _very painfully_! I went to youtube that very evening and listened to Heino's "Die Wacht am Rhein". I hope that doesn't turn me to a masochist, but be ensured that i have suffered not a little. I'm still standing. Ciao. --steffen ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot __________________________________ [email protected]
