[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 19 Jul 2011 17:28:29 +0200
From: Even Rouault <even.rouault@...es-paris.org>
To: oss-security@...ts.openwall.com, Jan Lieskovsky <jlieskov@...hat.com>
Cc: "Steven M. Christey" <coley@...us.mitre.org>, oss-security@...ts.openwall.com, Even Rouault <even.rouault@...es-paris.org>, Pavel Lisý <pavel.lisy@...il.com>, aboudreault@...gears.com
Subject: Re: CVE Request -- MapServer -- SQL injections in OGC filter encoding and in WMS time support.
Selon Jan Lieskovsky <jlieskov@...hat.com>:
Jan,
I believe Alan Boudreault (MapServer team member that I've added to the CC list)
has already asked the Debian security team to request for a CVE number, but
without any result for now. Maybe he can confirm.
Best regards,
Even
> Hello Josh, Steve, vendors,
>
> the following has been brought to our attention:
> [1] https://bugzilla.redhat.com/show_bug.cgi?id=722545
> [2] http://trac.osgeo.org/mapserver/ticket/3903
>
> More from [2]:
>
> This ticket is to track fixes to prevent SQL injections through OGC
> filter encoding (in WMS, WFS and SOS), as well as a potential SQL
> injection in WMS time support.
>
> Your system may be vulnerable if it has MapServer with OGC protocols
> enabled, with layers connecting to an SQL RDBMS backend, either natively
> or via OGR.
>
> All versions of MapServer 4.x, 5.x and 6.x are potentially vulnerable.
> All users are ** strongly encouraged ** to upgrade to one of the latest
> releases with the fixes.
>
> Could you allocate a CVE id for this?
>
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
