Re: duplicity stable update for CVE-2007-5201

2008-01-19 Thread Moritz Muehlenhoff
Alexander Zangerl <[EMAIL PROTECTED]> wrote: >>You can see the status of this vulnerability on: >>http://security-tracker.debian.net/tracker/CVE-2007-5201 > > can you update that info to show that we're in the green? Done. Cheers, Moritz -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] wi

Re: duplicity stable update for CVE-2007-5201

2008-01-19 Thread Thijs Kinkhorst
On Saturday 19 January 2008 04:53, Alexander Zangerl wrote: > the version in etch is 0.4.2-10.1 and hence doesn't contain the > problematic code. > > >You can see the status of this vulnerability on: > >http://security-tracker.debian.net/tracker/CVE-2007-5201 > > can you update that info to show th

Re: duplicity stable update for CVE-2007-5201

2008-01-18 Thread Alexander Zangerl
On Sun, 13 Jan 2008 19:03:23 +0100, Nico Golde writes: >the following CVE (Common Vulnerabilities & Exposures) id was >published for duplicity some time ago. > >CVE-2007-5201[0]: >| The FTP backend for Duplicity sends the password as a command line >| argument when calling ncftp, which might allow