oss-security - Re: CVE id request: ikiwiki

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Sat, 31 May 2008 15:46:36 +0200
From: Martin Schulze <joey@...odrom.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE id request: ikiwiki

Nico Golde wrote:
> Hi,
> Joey Hess discovered that if openid and passwordauth 
> plugins are both ennabled in ikiwiki which is the case in 
> the default installation anyone can log in using an openid 
> that has already been used to login into the wiki and 
> doesn't use a password.
> 
> This is Debian bug: http://bugs.debian.org/483770
> 
> As Steven is currently on semi-vacation, Martin can you 
> assign a CVE id for this issue from the Debian pool?

Please use CVE-2008-0169.

Regards,

	Joey

-- 
Experience is something you don't get until just after you need it.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.