Date: Mon, 16 Feb 2015 17:03:39 +0000 (UTC) From: Damien Regad <dregad@...tisbt.org> To: oss-security@...ts.openwall.com Subject: Re: CVE request: XSS in MantisBT Paul, OK, fine, so your original commit fixed the problem and my subsequent fix reintroduced part of the issue. Sorry about that, but shit happens. It have been nice however, if you had tested the code back then (i.e. before 1.2.18 was released) instead of today, but anyway what's done is done. Now, the facts: - we don't have any single release with just cabacdc2 (or a port of it) in it so it's pointless arguing that it actually fixed the issue. - In 1.3, cabacdc2 + 3d0625d8 together form at least a *partial* fix for CVE-2014-8986 (released in 1.3.0-beta.1) - In 1.2, e326b73a is a combination of the above 2 (released in 1.2.18) Can you please test the commits attached to  and confirm that they do indeed fully address the original issue. @Mitre, please let us know whether this warrants a new CVE (following the same logic as in ) or if I should refer to the existing CVE-2014-8986 for this.  https://www.mantisbt.org/bugs/view.php?id=19301  http://thread.gmane.org/gmane.comp.security.oss.general/14977/focus=15392
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ