[ovirt-devel] Release notes / announcements and security fixes

On 23/09/14 23:05, Sandro Bonazzola wrote: > [1] http://www.ovirt.org/OVirt_3.4.4_Release_Notes First, thanks for the new release, but I have one objection to make:

Hidden in the release notes we find: BZ 1139000 - CVE-2014-3573 ovirt-engine-backend: oVirt Engine: XML eXternal Entity (XXE) flaw in backend module So I'd like to discuss if security fixes should not be highlighted somewhat more? I'd expect the following: a) Mention at least that CVEs where fixed in this release in the announcement. b) a category "security patches" (or similar) in the release notes where these fixes get listed. c) This new category should be at the top of the release notes. What do you think?