Bug#877629: wordpress: CVE-2017-14990

2017-10-07 Thread Yves-Alexis Perez
On Sat, 2017-10-07 at 21:19 +0200, Yves-Alexis Perez wrote: > Thanks, please proceed with the upload to security-master (remember to build > with -sa since it's the first stretch security upload for wordpress). You can > upload a source-only package but you need to make sure there's no .buildinfo >

Bug#877629: wordpress: CVE-2017-14990

2017-10-07 Thread Yves-Alexis Perez
On Fri, 2017-10-06 at 20:35 +, Craig Small wrote: > Hi Yves-Alexis, > I have now applied that patch to the stretch version of wordpress. Other > than some minor problems (some comments had changed) the patch applied > cleanly. > You'll find the update at > > https://anonscm.debian.org/git/co

Bug#877629: wordpress: CVE-2017-14990

2017-10-06 Thread Craig Small
Hi Yves-Alexis, I have now applied that patch to the stretch version of wordpress. Other than some minor problems (some comments had changed) the patch applied cleanly. You'll find the update at https://anonscm.debian.org/git/collab-maint/wordpress.git/commit/?h=stretch&id=5c88ea7390caed18e9c986

Bug#877629: wordpress: CVE-2017-14990

2017-10-04 Thread Yves-Alexis Perez
On Tue, 2017-10-03 at 23:06 +, Craig Small wrote: > I will add this to the security release you just reviewed and get you to re- > review it :/ > Thanks, don't worry it's not that bad, it's just one patch after all. No need to send a new debdiff, just push your changes to git and I'll review

Bug#877629: wordpress: CVE-2017-14990

2017-10-03 Thread Craig Small
I will add this to the security release you just reviewed and get you to re-review it :/ - Craig -- Craig Small https://dropbear.xyz/ csmall at : enc.com.au Debian GNU/Linuxhttps://www.debian.org/ csmall at : debian.org Mastodon: @smalls...@social.dropbear.xyz

Bug#877629: wordpress: CVE-2017-14990

2017-10-03 Thread Yves-Alexis Perez
On Tue, 2017-10-03 at 17:17 +0200, Salvatore Bonaccorso wrote: > Source: wordpress > Version: 4.8.2+dfsg-1 > Severity: important > Tags: upstream security > Forwarded: https://core.trac.wordpress.org/ticket/38474 > > Hi, > > the following vulnerability was published for wordpress. > > CVE-2017-1

Bug#877629: wordpress: CVE-2017-14990

2017-10-03 Thread Salvatore Bonaccorso
Source: wordpress Version: 4.8.2+dfsg-1 Severity: important Tags: upstream security Forwarded: https://core.trac.wordpress.org/ticket/38474 Hi, the following vulnerability was published for wordpress. CVE-2017-14990[0]: | WordPress 4.8.2 stores cleartext wp_signups.activation_key values (but | s