Re: [libvirt] [PATCH] qemu: Let empty default VNC password work as documented
On Thu, Jun 30, 2016 at 10:30:55AM +0200, Jiri Denemark wrote:
On Thu, Jun 30, 2016 at 09:15:25 +0100, Daniel P. Berrange wrote:
> On Thu, Jun 30, 2016 at 09:28:24AM +0200, Jiri Denemark wrote:
> > CVE-2016-5008
> >
> > Setting an empty graphics password is documented as a way to disable
> > VNC/SPICE access, but QEMU does not always behaves like that. VNC would
> > happily accept the empty password. Let's enforce the behavior by setting
> > password expiration to "now".
> >
> > https://bugzilla.redhat.com/show_bug.cgi?id=1180092
> >
> > Signed-off-by: Jiri Denemark <jdenemar(a)redhat.com>
> > ---
> > src/qemu/qemu_hotplug.c | 14 +++++++-------
> > 1 file changed, 7 insertions(+), 7 deletions(-)
>
> ACK, please push for 2.0.0
Thanks and pushed.
I've applied this to all branches going back to 0.9.12
ALthough its also broken in back to 0.8.7, the backport got too tedious
to bother with resolving past 0.9.12 and I doubt anyone cares about such
old branches
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|