Hacker News new | ask | show | jobs
by Blikkentrekker 928 days ago
So this is another bug introduced by Debian itself by patching things?

I remember that there was a fairly severe one which was caused by patching OpenSSL I think? But I remember the change they made being fairly weird and no one understood why but it was easy to see that it would introduce a vulnerability.
3 comments
mordae 928 days ago
No, the issue was caused by backporting a patch A but not backporting a patch B. Sadly in this case the overall behavior after applying just A was broken when issuing direct IO writes.
link
keep_reading 928 days ago
I remember when they made 2 CVEs back to back in Apache by incorrect back porting of changes
link
remram 928 days ago
No, it exists in the upstream release.
link