Quoting Debian Security Advisory for mysql-ocaml: ------------------------------------------------- It was discovered that mysql-ocaml, OCaml bindings for MySql, was missing a function to call mysql_real_escape_string(). This is needed, because mysql_real_escape_string() honours the charset of the connection and prevents insufficient escaping, when certain multibyte character encodings are used. The added function is called real_escape() and takes the established database connection as a first argument. The old escape_string() was kept for backwards compatibility. References: ----------- http://www.debian.org/security/2009/dsa-1910 Debian patch for Lenny: ----------------------- http://security.debian.org/pool/updates/main/m/mysql-ocaml/mysql-ocaml_1.0.4-4+lenny1.diff.gz
This issue affects the version of ocaml-mysql package, as shipped with Fedora releases of 10 and 11. Please fix.
Created attachment 365024 [details] Local copy of relevant bits from ocaml-mysql-CVE-2009-2942-lenny.patch
Built for dist-f13, F12, F11, F10. Same problem as before associating this BZ with the update: $ make update [...] Creating a new update for ocaml-mysql-1.0.4-8.fc11.1 Password for rjones: Creating a new update for ocaml-mysql-1.0.4-8.fc11.1 Update successfully created. Unable to access one or more bugs: <Fault 411: 'Password Expired'> ================================================================================ ocaml-mysql-1.0.4-8.fc11.1 ================================================================================ Release: Fedora 11 Status: pending Type: security Karma: 0 Request: testing Notes: Patch for CVE 2009-2942 Missing escape function (RHBZ#529321). Submitter: rjones Submitted: 2009-10-16 10:54:54 https://admin.fedoraproject.org/updates/ocaml-mysql-1.0.4-8.fc11.1
(In reply to comment #3) > Unable to access one or more bugs: <Fault 411: 'Password Expired'> https://fedorahosted.org/fedora-infrastructure/ticket/1737
ocaml-mysql-1.0.4-3.fc10.1 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
ocaml-mysql-1.0.4-8.fc11.1 has been pushed to the Fedora 11 stable repository. If problems still persist, please make note of it in this bug report.