[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 15 Jan 2016 20:32:49 +0100
From: Tomas Hoger <thoger@...hat.com>
To: cve-assign@...re.org
Cc: corsac@...ian.org, oss-security@...ts.openwall.com
Subject: Re: Re: Qualys Security Advisory - Roaming through
the OpenSSH client: CVE-2016-0777 and CVE-2016-0778
On Fri, 15 Jan 2016 12:10:16 -0500 (EST) cve-assign@...re.org wrote:
> > There's also a fix related to X11 forwarding which seems different than
> > the fix which went into OpenSSH 6.9. I'm not sure if it deserves a CVE
> > or not.
>
> > https://anongit.mindrot.org/openssh.git/commit/?id=ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c
>
> >> eliminate fallback from untrusted X11 forwarding to trusted forwarding
> >> when the X server disables the SECURITY extension; Reported by Thomas
> >> Hoger
>
> MITRE is not assigning a CVE ID for
> ed4ce82dbfa8a3a3c8ea6fa0db113c71e234416c at this time. First, the
> (misspelled) reporter name suggests that the issue might have already
> had a CVE ID assigned by Red Hat before the issue became public. Also,
> http://www.openssh.com/txt/release-7.1p2 does not announce this as a
> security fix. Finally, the wording suggests that it could possibly be
> an interoperability fix, not a security fix.
FYI, this issue was announced as a security fix in 7.1p2 release notes:
https://lists.mindrot.org/pipermail/openssh-unix-dev/2016-January/034680.html
However, as the fix was not actually included in 7.1p2, the
release-7.1p2 announcement as available on the url listed above was
modified to remove mention of that issue.
https://lists.mindrot.org/pipermail/openssh-unix-dev/2016-January/034684.html
--
Tomas Hoger / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
