© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
67d34a1
(Get the code!)
I would like to propose that this bug receive the wont-fix status for the moment.
The CVE reports that SSL communication is not forced in the intended situations. After speaking to some wordpress developers on IRC, it was said that SSL was only introduced into wordpress 2.6+. Ubuntu currently contains 2.5 and below and the SSL functionality is not included in this version, therefore the CVE doesnt really apply.
Debian has created a patch (shown in the debdiff attached to this bug report) - that backports the SSL functionality and some functions into 2.5. I believe this is not a true security patch, but more of a SRU. There have also been numerous fixes to the SSL implementation in the wordpress 2.6 tree that are not backported in that patch.
The first upload into Debian actually broke wordpress functionality, and was fixed in a subsequent upload [1][2].
Wordpress 2.6 should make it into Jaunty - where SSL will be fixed as per upstream. There is also a Debian bug filed for the upgrade [3].
If anyone would like to comment or re-open this bug, please feel free to do so. I am leaving the debdiff for Intrepid (with the Debian patch) attached to this bug in case we would still like to make the debian change.
[1] http://
[2] http://
[3] http://