Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don't know if it's in the default build script, but it doesn't really matter -- most people install precompiled binaries.


So nobody running a precompiled binary of their favorite Linux distribution should be affected because distributors should run the full test suite across all supported architectures when they package the binary?

Debian for example shipped vulnerable packages: https://security-tracker.debian.org/tracker/CVE-2022-2274


It's one thing to run the full test suite across all supported architectures. It's quite another to run the full test suite across all supported CPUs. The vast majority of x86-64 CPUs do not trigger this bug.


Should be noted that the only version marked as vulnerable, "Bookworm", is the "testing" version that has not been officially released yet and has no "security policy" other than best-effort. Its purpose is for testing the next stable release, not for everyday use. Vulnerabilities in the stable or even oldstable releases are fixed much faster and tested much more thoroughly.


still seems like they should run build testing as part of that 'best-effort' (assuming that's what is meant by the advisory's 'proper testing')


What the heck, Debian?


"openssl security team accuses debian of not performing proper testing"




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: