oss-security - CVE request for planet

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 8 Oct 2009 11:13:22 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request for planet

A second vulnerability was found by Secunia in planet, that differs from
CVE-2009-2937.  Details are available here:

https://bugzilla.redhat.com/show_bug.cgi?id=525772
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=546178#30

There is a bit of confusion surrounding the two issues, but it seems as
though they are, in fact, two separate issues.  The first
(CVE-2009-2937) deals with insufficient escaping of input feeds, while
the second deals with some CDATA filtering problems as well.

Steve, does this warrant a second CVE or should the CDATA filtering fall
under CVE-2009-2937 as well?

Thanks.

-- 
Vincent Danen / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.