Re: Shellshock-vulnerable version still most obvious on ftp.gnu.org

[Chet Ramey]

On 11/5/14, 7:35 AM, Ian Jackson wrote:
> If you go to ftp://ftp.gnu.org/pub/gnu/bash/, the most obvious most
> recent version of bash is this:
>   ftp://ftp.gnu.org/pub/gnu/bash/bash-4.3.tar.gz
>   ftp://ftp.gnu.org/pub/gnu/bash/bash-4.3.tar.gz.sig
> The shellshock fix is hidden in a subdirectory:
>   ftp://ftp.gnu.org/pub/gnu/bash/bash-4.3-patches/
> 
> This is not mentioned on the main bash webpage here:
>   http://www.gnu.org/software/bash/
> 
> Could there please be a new full tarball release of the patched
> version ?

This is from tiswww.case.edu/~chet/bash/bashtop.html:

A downloadable tar file of the current version with all official patches
applied is available from savannah.

(The link is to
http://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-master.tar.gz).  I
cannot change the main bash webpage to include that
text.

I will put tarballs with patches in the usual places within a few days.

Chet
-- 
``The lyf so short, the craft so long to lerne.'' - Chaucer
                 ``Ars longa, vita brevis'' - Hippocrates
Chet Ramey, ITS, CWRU    chet@case.edu    http://cnswww.cns.cwru.edu/~chet/