Date: Fri, 22 May 2015 08:42:47 -0400 (EDT) From: cve-assign@...re.org To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: Re: CVE request: Multiple SQL injection vulnerabilities in GigPress - WordPress plugins. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Multiple SQL injection vulnerabilities in GigPress (WordPress plugin) > I request a CVE for the same. Yes, MITRE is able to provide a CVE ID. (We will do this soon, regardless of the outcome below.) What apparently occurred in the previous case this week was that the WordPress plugin changelog URL was sent here, then the CVE ID was sent here, and then the CVE ID was used on fulldisclosure, i.e., http://openwall.com/lists/oss-security/2015/05/18/8 http://openwall.com/lists/oss-security/2015/05/18/10 http://seclists.org/fulldisclosure/2015/May/75 The MITRE CVE project is currently willing to follow that pattern for some number of WordPress plugin disclosures. A possible advantage for other people is receiving notification of security-relevant plugin changelogs earlier. A possible disadvantage for other people is three times as many public messages per disclosure. If this disadvantage is very important, you can (among other options) send e-mail directly to only cve-assign@...re.org to tell us. As far as we know, the list guidelines at http://oss-security.openwall.org/wiki/mailing-lists/oss-security would imply that all of: http://openwall.com/lists/oss-security/2015/05/18/8 http://openwall.com/lists/oss-security/2015/05/20/6 http://openwall.com/lists/oss-security/2015/05/22/2 are "Public security issues" that oss-security subscribers might want to know about. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVXyPDAAoJEKllVAevmvmsu3AH/RSc8NVcuW77TXcpl3JiOygW pTDrmSoF8bXfXpGA5OCDzwCZKXh4o3L/fgy/BaJYXaYi6s3d4M1I/k5nJaJ59p0R XY1RC75Ow0Hbwi/6TkK0Tj+Ix4X8QMekdh+pfzPQ1AgZSQlgGvqDhkCzIViwVWtp WrzSAV3mCWkA+RVBKbbhco1ruDfSGbtUY/MF+XgefQHKErB3+6H4vwEI0j27Il+I noDqElpaztpz5CyqoUMnu+vQWQwHIj1MyBXNb9gLvTpm/YMXD5nab9SkJtVfp8/6 /YB3o4O22t643LFdHZJWNaWQA9pq2xCD+5u+J/8/F26/cMDrMOpcR9EGHXLLy44= =S50W -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ