http://bugzilla.suse.com/show_bug.cgi?id=1150532 http://bugzilla.suse.com/show_bug.cgi?id=1150532#c2 --- Comment #2 from Matthias Gerstner --- On second thought: localhost port 3142 is unprivileged and thus a local user could fire up a fake server. The acngtool only wants to trigger something at the server but to do so generic HTTP processing is involved. This HTTP processing is done with seemingly custom HTTP handling code in source/dlcon.cc. It also supports HTTP chunked encoding which has been a source of security issues in other packages in the past. A first look into the handling of this looks okay in the code. -- You are receiving this mail because: You are on the CC list for the bug.

http://bugzilla.suse.com/show_bug.cgi?id=1150532 http://bugzilla.suse.com/show_bug.cgi?id=1150532#c4 Matthias Gerstner changed: What |Removed |Added ---------------------------------------------------------------------------- Depends on| |1157703 Depends on| |1157706 Status|IN_PROGRESS |RESOLVED CC|mpluskal@suse.com | Depends on|1157703, 1157706 | Resolution|--- |WONTFIX --- Comment #4 from Matthias Gerstner --- Since there's no maintainer left for apt-cacher-ng I've filed a delete request for the package in Factory. This delete request got accepted by now. I'm decoupling this bug from the CVE sub-bugs. For the CVE I've submitted maintenance update for Leap myself. Therefore no whitelisting for apt-cacher-ng regarding the cron job is necessary. Closing this bug as WONTFIX. -- You are receiving this mail because: You are on the CC list for the bug.