Re: Xerces-C V3.2.5 now available

On 2024/01/11 16:27:22 "Cantor, Scott" wrote:
> > With respect to the advisory, since the original one[0] claims the issue was
> > fixed in 3.2.3, we're not allowed to 'widen' the version range, we'll have to
> > allocate a new one[1]. I can take care of that on your behalf if you prefer?
> 
> I updated the existing advisory [1] when I did the release, so if something else needs to happen that would need to be handled by others.

Gotcha! I have populated https://cveprocess.apache.org/cve5/CVE-2024-23807 and unless there's any objections I'll publish it in a few days.

> > Also, I noticed the download page still seem to be referring to 3.2.0 - it
> > might be nice to update that as well :).
> 
> The page I control is inside the generated site [2], I don't know what the other pages might be or how they're managed.
> 
> My suggestion would be to get rid of that (or at least the sections pertaining to Xerces-C). Duplication isn't ideal for this sort of thing, I can't maintain the information in multiple places. But I don’t know who would be able to excise that material.

Sounds good to me! I think the change could look something like https://paste.apache.org/3cuav , but I don't have the authorizations to push that to https://svn.apache.org/viewvc/xerces/site/trunk/production/ .


Kind regards,

Arnout

> [1] https://xerces.apache.org/xerces-c/secadv/CVE-2018-1311.txt
> [2] https://xerces.apache.org/xerces-c/download.cgi