Re: Problems with shim and shim-signed in unstable, and proposed solutions to unblock us

2019-03-04 Thread Cyril Brulebois
Steve McIntyre (2019-03-04): > And Mark says: > > "we don't want to go rewinding version numbers in unstable; that could > lead to all sorts of unforeseeable breakage. > > much as we'd expected. Any more feedback please? Cyril prefers > approach #2 below, I prefer #3. To clarify: #2 was my pref

Re: Problems with shim and shim-signed in unstable, and proposed solutions to unblock us

2019-03-04 Thread Steve McIntyre
I've had a reply from Mark (ftpteam) in IRC: On Sun, Mar 03, 2019 at 11:35:45PM +, Steve McIntyre wrote: ... >So, we're looking at three hacky options options here to work our way >out of this hole. In (probably?) descending order of hackitude: > >1. Ask the nice ftpmaster people to

gnutls/nettle (CVE-2018-16868/CVE-2018-16869)

2019-03-04 Thread Sylvain Beucler
Hi, I'm working on CVE-2018-16868/CVE-2018-16869, a side-channel attack that affects gnutls and nettle, disclosed 2018-12, tagged low/local. Unlike what I read in data/CVE/list, I understand that the nettle fix is not just a new function - it's a rewrite of the RSA functions, completemented by a