Date: Thu, 16 Jan 2014 07:52:24 -0500 (EST) From: cve-assign@...re.org To: ratulg@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE Request: drupal: multiple vulnerabilities corrected in 6.30 and 7.26 (SA-CORE-2014-001) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > 1) Impersonation (OpenID module - Drupal 6 and 7 - Highly critical) Use CVE-2014-1475. > 2) Access bypass (Taxonomy module - Drupal 7 - Moderately critical) > > The Taxonomy module provides various listing pages which display content > tagged with a particular taxonomy term. Custom or contributed modules > may also provide similar lists. Under certain circumstances, unpublished > content can appear on these pages and will be visible to users who > should not have permission to see it. Use CVE-2014-1476 for the vulnerability in the Taxonomy module. The other information seems to have at least two possible interpretations. One interpretation is that this vulnerability in the Taxonomy module affects whether it is safe for other modules to have these "similar lists." A second interpretation is that "tagged with a particular taxonomy term" means that the attack involves a crafted taxonomy term. In this second interpretation, a custom or contributed module may require its own vulnerability fix to block the crafted taxonomy term. In that situation, each contributed module may require its own CVE ID, because those issues would not be within the scope of CVE-2014-1476. > 3) Security hardening (Form API - Drupal 7 - Not critical) > To facilitate this, a new, optional > $form_state['programmed_bypass_access_check'] element has been added There is no CVE for the action of adding this functionality to Drupal core. > provides a method for custom or contributed code to fix security > issues that would be difficult or impossible to fix otherwise. If contributed code uses this element to address a vulnerability, each such vulnerability may be eligible for a CVE ID. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJS19SWAAoJEKllVAevmvmsCG4IAJ9J9l6zio9tZzXZamxuGS6O EeTkI+u4GIYZPNgDO/SLdlws6OuAG11lvbt0IcQWF9ngYqAtgfcazoOUpenOPXJj 6Vs5x4p29QutF6fv25zvQWzu/CCxLTDLIBJJkE2huMthSbq4/wKEG7Qp4sYvUJ/Z 6Em5aLP/J2VSvVQnUbDFv181kl1XyadRnKw8pCSXoPvGWGm2apWSjanTmT+2kYY3 uBBC1OqktbjIJJULZgYQ3x94JKixG5B/cMxZKA8Z2D95toE1D6xPPhetp5B5QuBC PH484Hh+pAq3/r0e6f8UUgUifhPSLakuWSKbfLyo4t5dmnvTIKfZ3C7XBuxcOEM= =1RjG -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ