Re: Bash 2.05b patch for 896776 - (CVE-2014-6271) ?

[Jean-Christian de Rivaz]

Le 26. 09. 14 18:55, Steve Simmons a écrit :
> These patches build and run without problem in our initial bash2 tests. However, I notice 
> that both the version number reported by ./bash --version and doing ./bash followed by 
> echo $BASH_VERSION both report "2.05b.0(1)-release". All versions that I've 
> tested of bash3 and bash4 report their patchlevel in the third field. If I manually 
> update patchlevel.h to change from 0 to 9, the version is reported as 
> '2.05b.((1)-release'. Bug?
>
> Steve
I have observer that too. I searched into the source code and found that 
while
the mkversion.sh script have a patchlevel option, the Makefile.in do not 
seem
to be designed to use that feature prior to the 3.x version.

I wonder if adding a patch level in the version string might break code that
parse it to workaround some compatibility issues. On my side, I am fine with
a sticky version string for that old setup.

Jean-Christian