Re: Cutting 2.6.4 release to address CVE-2021-22160

2021-05-27 Thread Shivji Kumar Jha
+1 Regards, Shivji Kumar Jha http://www.shivjijha.com/ +91 8884075512 On Fri, 28 May 2021 at 10:45, Enrico Olivelli wrote: > +1 > > Thanks > > Enrico > > Il Ven 28 Mag 2021, 05:37 r...@apache.org ha > scritto: > > > LGTM +1 > > -- > > Thanks > > Xiaolong Ran > > > > Lari Hotari 于2021年5月28日周五

Re: Cutting 2.6.4 release to address CVE-2021-22160

2021-05-27 Thread Enrico Olivelli
+1 Thanks Enrico Il Ven 28 Mag 2021, 05:37 r...@apache.org ha scritto: > LGTM +1 > -- > Thanks > Xiaolong Ran > > Lari Hotari 于2021年5月28日周五 上午2:40写道: > > > Dear Pulsar community members, > > > > I'd like to propose cutting a 2.6.4 release so that we can > > address CVE-2021-22160 [1] also in

Re: Cutting 2.6.4 release to address CVE-2021-22160

2021-05-27 Thread r...@apache.org
LGTM +1 -- Thanks Xiaolong Ran Lari Hotari 于2021年5月28日周五 上午2:40写道: > Dear Pulsar community members, > > I'd like to propose cutting a 2.6.4 release so that we can > address CVE-2021-22160 [1] also in 2.6.x. The fix for CVE-2021-22160 is > included in 2.7.1 . > > Here [2] you can find the list of

Re: Cutting 2.6.4 release to address CVE-2021-22160

2021-05-27 Thread Sijie Guo
+1 On Thu, May 27, 2021 at 11:40 AM Lari Hotari wrote: > Dear Pulsar community members, > > I'd like to propose cutting a 2.6.4 release so that we can > address CVE-2021-22160 [1] also in 2.6.x. The fix for CVE-2021-22160 is > included in 2.7.1 . > > Here [2] you can find the list of commits che

Re: Cutting 2.6.4 release to address CVE-2021-22160

2021-05-27 Thread Michael Marshall
+1 for releasing 2.6.4 with the fix for the CVE, as this is still an active branch that should receive security patches. I’ll be following up with an email to the ML to discuss creating a process to more formally let our users know which versions will receive security patches. Thanks, Michael

Cutting 2.6.4 release to address CVE-2021-22160

2021-05-27 Thread Lari Hotari
Dear Pulsar community members, I'd like to propose cutting a 2.6.4 release so that we can address CVE-2021-22160 [1] also in 2.6.x. The fix for CVE-2021-22160 is included in 2.7.1 . Here [2] you can find the list of commits cherry-picked to branch-2.6 since 2.6.3 release. I would like to volunte