Date: Sat, 13 Oct 2012 13:48:50 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Vincent Danen <vdanen@...hat.com>, security@...y-lang.org Subject: Re: CVE request: ruby file creation due in insertion of illegal NUL character On 10/12/2012 02:50 PM, Vincent Danen wrote: > Just noticed this today on ruby's web site: > > http://preview.ruby-lang.org/en/news/2012/10/12/poisoned-NUL-byte-vulnerability/ > > > The fix is located here: > > http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&revision=37163 > > I don't see a CVE name associated with the announcement or commit, so > I don't believe one has been assigned. > Agreed, user controlled file creation in this manner is definitely a security issue. Please use CVE-2012-4522 for this issue. Also please note that this email is not signed because I'm travelling and don't have access to my GPG keys currently. -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ