From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail02.groups.io (mail02.groups.io [66.175.222.108]) by spool.mail.gandi.net (Postfix) with ESMTPS id 26817D802AD for ; Tue, 23 Jan 2024 16:35:54 +0000 (UTC) DKIM-Signature: a=rsa-sha256; bh=CWtEecihqTMMhQ41lYQojKmY0fCdfSql23grKRDidNk=; c=relaxed/simple; d=groups.io; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Precedence:List-Subscribe:List-Help:Sender:List-Id:Mailing-List:Delivered-To:Reply-To:List-Unsubscribe-Post:List-Unsubscribe:Content-Type:Content-Disposition; s=20140610; t=1706027753; v=1; b=PvfiTvxp2aePECItXkqXIBjlUCyQusJaATisJxMdbrElZQwFF3o1+dLDfkkOGb68c59nNa1U Rzzav4F0ll2v6XK1clCmt+Qm0dVwWL1PqL84oVr5086p/sFf3em7ytzWvEVdxqyDzfOJVFiDdBR hI85qJnGuPM97JbdsQ60Bmr8= X-Received: by 127.0.0.2 with SMTP id gLZuYY7687511xJz5SFVDod0; Tue, 23 Jan 2024 08:35:53 -0800 X-Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by mx.groups.io with SMTP id smtpd.web11.17629.1706027753152352858 for ; Tue, 23 Jan 2024 08:35:53 -0800 X-Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-333-kmSl8WWAPaGzrhBrUD7x4w-1; Tue, 23 Jan 2024 11:35:51 -0500 X-MC-Unique: kmSl8WWAPaGzrhBrUD7x4w-1 X-Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.rdu2.redhat.com [10.11.54.7]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id B4AE73812588; Tue, 23 Jan 2024 16:35:50 +0000 (UTC) X-Received: from sirius.home.kraxel.org (unknown [10.39.193.66]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 9128E1C060AF; Tue, 23 Jan 2024 16:35:50 +0000 (UTC) X-Received: by sirius.home.kraxel.org (Postfix, from userid 1000) id 9D0BB180038B; Tue, 23 Jan 2024 17:35:49 +0100 (CET) Date: Tue, 23 Jan 2024 17:35:49 +0100 From: "Gerd Hoffmann" To: devel@edk2.groups.io, dougflick@microsoft.com Cc: Jon Maloy Subject: [edk2-devel] pixiefail Message-ID: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.7 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Precedence: Bulk List-Subscribe: List-Help: Sender: devel@edk2.groups.io List-Id: Mailing-List: list devel@edk2.groups.io; contact devel+owner@edk2.groups.io Reply-To: devel@edk2.groups.io,kraxel@redhat.com List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: X-Gm-Message-State: zRPG8VHyBkMHeBYGr1b7wAKix7686176AA= Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-GND-Status: LEGIT Authentication-Results: spool.mail.gandi.net; dkim=pass header.d=groups.io header.s=20140610 header.b=PvfiTvxp; spf=pass (spool.mail.gandi.net: domain of bounce@groups.io designates 66.175.222.108 as permitted sender) smtp.mailfrom=bounce@groups.io; dmarc=fail reason="SPF not aligned (relaxed), DKIM not aligned (relaxed)" header.from=redhat.com (policy=none) Hi, What is the state of affairs wrt. the pixiefail vulnerabilities? The advisory is published (https://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h), it says the plan is to have the fixes included in the next (Feb 2024) stable tag. I see bugzilla has patches attached, most of them written by Doug Flick. There is not that much time left until code freeze starts. Shouldn't we get the ball rolling to get the patches reviewed and merged? Given that the pixiefail details where published last week it should be ok to simply send the patches to the devel list for review. thanks & take care, Gerd -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#114216): https://edk2.groups.io/g/devel/message/114216 Mute This Topic: https://groups.io/mt/103913088/7686176 Group Owner: devel+owner@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [rebecca@openfw.io] -=-=-=-=-=-=-=-=-=-=-=-