Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20090120090231.1cda36f4@redhat.com>
Date: Tue, 20 Jan 2009 09:02:31 +0100
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: fw@...eb.enyo.de, coley@...us.mitre.org
Subject: Re: CVE request -- git

On Mon, 19 Jan 2009 21:57:03 +0100 Florian Weimer <fw@...eb.enyo.de>
wrote:

> Nerver mind, Novell used CVE-2008-5517 for this.

No, they have not.  They fixed both -5516 (git_search) and -5517
(git_snapshot and git_object) issues using quote_command() (in their
git-1.5.2.4-24.4.src.rpm).  No idea why only one of the CVEs was
mentioned in the security report...  They don't seem to include any
patch for diff.external issue, or claim to have fixed it.

So -5517 is now really used to refer to two different issues...

> (the CVE description is somewhat misleading, I think):

With little further details in SuSE security report, I think the
description is quite appropriate - unspecified remote hole related to
shell metacharacters.  Adding the two repo.or.cz links was most likely
a guess, not a good one though.

Mitre was notified about this inconsistency in the -5517 description
and references.

-- 
Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.