[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 8 Aug 2013 14:16:39 -0600
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Paul Gevers <elbrus@...ian.org>, Gandalf <gandalf@...ti.net>
Subject: Re: CVE Request: Regression introduced in cacti with
fix for CVE-2013-1435
* [2013-08-08 21:20:59 +0200] Salvatore Bonaccorso wrote:
>Hi Kurt
>
>The fix for CVE-2013-1435[1] introduced a regression:
>
> [1] http://svn.cacti.net/viewvc?view=rev&revision=7393
>
>It was reported in [2] and upstream proposed a fix [3] which was
>confirmed to work by two of the involved people.
>
> [2] http://sourceforge.net/mailarchive/message.php?msg_id=31262707
> [3] http://sourceforge.net/mailarchive/message.php?msg_id=31262712
>
>The corresponding svn commits should be the following:
>
> [4] http://svn.cacti.net/viewvc?view=rev&revision=7408
> [5] http://svn.cacti.net/viewvc?view=rev&revision=7409
> [6] http://svn.cacti.net/viewvc?view=rev&revision=7413
>
>Does this need a follow-up CVE assignment for the regression part
>introduced?
My understanding would be no. A follow-up CVE would be assigned if it
a) didn't fix the underlying security issue (it does) or b) introduced a
new security issue (it doesn't).
Botching the fix so that _functionality_ no longer works would not be
grounds for another CVE (although anyone backporting these would surely
want the additional fixes).
--
Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
