[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 10 Apr 2012 13:08:07 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Greg Knaddison <greg.knaddison@...uia.com>
Subject: Re: CVE's for Drupal Contrib 2012 001 through 057
(67 new CVE assignments)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 04/10/2012 10:30 AM, Greg Knaddison wrote:
> I had a few questions/comments as I updated these - inline below:
>
> "NO CVE","SA-CONTRIB-2012-050","CDN2 Video -
>> Unsupported","https://drupal.org/node/1506542"
>>
>
> While the backend service and module are no longer active, there
> are 70 sites using this module who are vulnerable to CSRF/XSS. What
> is the reason not to give it a CVE?
I was under the impression that if the backend was off the plugin
wouldn't work/expose the vuln, I could of course be wrong, if so I'll
assign a CVE.
>
>> "NO CVE","SA-CONTRIB-2012-056","Janrain Engage - Sensitive Data
>> Protection Vulnerability","https://drupal.org/node/1515282"
>>
>
> We debated a bit about this one and whether to make it an SA or
> not. In the end we decided that if a module were persisting the
> password in plain text that would deserve an SA so this one
> (persisting a login token in plain text) should also get an SA. Do
> you have any guidance on how you think we should have handled it?
Well the CVE inclusion decisions:
Pro assignment:
Does exploitation of the issue provide the attacker with extra
privileges or information, or cause a denial of service, that the
attacker would not already have before they attempt to exploit the issue?
Anti-assignment:
Is the issue site-specific? Is it only in an online service
(software-as-a-service), on a specific web site, or only offered
through hosting solutions that are under the full control of the vendor?
Does the issue only affect a version that was never made generally
available to the vendor's customers?
> If you have any further suggestions on how we can improve the
> content or formatting of the SAs please let me know.
Direct links to the code commits fixing them would be nice =)
> Thanks, Greg
>
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJPhIUXAAoJEBYNRVNeJnmTfGkP/3huqD45i6hpUn5QtkhmRH3L
p/RpE2/muJIhyBFCYpTDQN4fqlt5TjHFLMCjDrm/be9h51mq54n4KNXLXGMPeax/
ZDqg0LzZiTW918R5+zfIOtsf/rvUziT3GpNyOTVjWdNDa5hCF+SOeBiylXBIGVwk
z1rYhC5r37FO5dmfgjk1fVCnprbKDavJjLaDn3kiPpDyj+UFUgEyiif/iTn1zJGh
UazjNE8gxWB8NaLodihFZHqSy9aEUmoRSy0EPqFlbKPWHZzNvs4ju2MWuBjn+S/t
lebnnvXcknnTbpQM1fm5AkC6GiXxblxgcRsJPzz2moAqfHg1uRl7s5W3IoZnoPCY
Vw86JUWlDvQG9JNR0i7fGFsfBCN9K0M+i1zIa8ZqKNDZr6fiFULFZP7270bsPoYd
SIPQDBb25hbri8v6MpomHFUFQa55LI+/10kGPshTt1fyOJMLDHfbsrj2OtU5Iy/p
ehTTQUyZpSMQr/NoBNFIpuxbtKoGjIb1+F+RjQXJsCoeqbX2WniUGXXcRhhjzDtd
aJIwfv6Tg7j838IwZPiKQwjho8a0bew4TXjwEBIqKm4ljm/c8tL5j/8Dqs1EShqn
VB+5iRZF9tIfShZJuASGZq9oapwxjQvgd+V8yzq68EiUfWqOHWF6r0Gyme1UVZUK
sWGz+Vgf3GyJVKWx+s/5
=jemE
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
