----- Original Message -----
From: Eric Niebler <eric@boostpro.com>
It is in release notes quoting: Locale: * Security related bug fix, some invalid UTF-8 sequences where accepted as valid #7743 Also maybe it need to be more Release managers, maybe we need to make it bolder? Yes, I think this warrants a bolder announcement, like the one we did last release for the potentially breaking result_of change. Here I'm thinking of the red warning on the front page, not necessarily a separate page describing the issue. The red warning could simply link directly to the 1.53 release notes. Daniel, thoughts? -- Eric Niebler BoostPro Computing http://www.boostpro.com
What is more disturbing me that we do not have **standard and ready** to go way of handling such situation. I think we need a general policy what to do if some bug that may affect application security or introduce a potential vulnerability to an application is discovered. It is not the first time (and of course it would not be the last time) that such a situation happens. For example, there is a bug in UUID that was fixed in 1.43 should get much more serious attention: https://svn.boost.org/trac/boost/ticket/3971 It is uncommon case when generation on unpredictable UUID is used ad application relay on that (for example session key). Also, I'm not sure if the author was aware how critical this bug was, but such a bug should be treated much more seriously that small line in Boost 1.43 UUID notes. Probably potential vulnerabilities should be: 1. Published in a central place, including the information about which Boost versions are affected. 2. Exact security risk should be described. 3. A patch that can fix them should be given. You should remember, that for example many Linux distributions deliver older Boost version and support of for a long time. End even distributions with a short release cycle need to provide security updates for their packages for at least for about year or two, but sometimes for much longer period as like RHEL, Debian or Ubuntu LTS. The fact that Boost does release bug fixes for older versions makes the work of package maintainers for Linux distributions much harder. Such central documentation and page should be available and keep a track of all potential vulnerabilities, and of course it should not be tied to release cycle. Artyom Beilis -------------- CppCMS - C++ Web Framework: http://cppcms.com/ CppDB - C++ SQL Connectivity: http://cppcms.com/sql/cppdb/