Date: Mon, 15 Feb 2010 19:12:09 +0100 From: Thomas Waldmann <tw-public@....de> To: oss-security <oss-security@...ts.openwall.com> Cc: "Steven M. Christey" <coley@...us.mitre.org> Subject: Re: CVE Request -- MoinMoin -- 1.8.7 Hi, sorry about being rather vague in what I told/tell about the issues, but this is just to protect the vulnerable systems out there until fixes are available and have been widely deployed (or at least every admin interested in security had a chance). All the recently discovered issues are basically just 2 issues (the sys.argv issue in 1.9 and the other issue more or less in all moin versions at different places in the code). > Last message in: >  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=569975#10 > suggests only the "superuser list" issue was fixed in 1.8.7 No, all known issues that affect 1.8 (and also all versions before) were fixed in 1.8.7. > and more fixes are about to come -- "<ThomasWaldmann> > 1.9.2 planned in about 1 or 2 weeks". 1.9.2 will fix all known issues that affect 1.9. The sys.argv issue was already fixed by 1.9.1. BTW, we won't do a new 1.7.x release, but the fixes can be pulled from the repo. Likely this is interesting for package maintainers who have to support 1.7.x packages with security fixes. Users who just manually downloaded and installed 1.7.x are advised to just do an easy upgrade to 1.8.7 (or even 1.9.2 soon, with a bit more work needed). > what was fixed to know, how many CVE identifiers are needed / sufficient > for MoinMoin of version v.1.8.7. I am not very familiar with CVE stuff, but as there are 2 fundamental problems that have been fixed, I guess 2 CVEs are right. a) one CVE for the sys.argv issue in 1.9 that was fixed in 1.9.1 b) one CVE for the other kind of issues in all moin versions, fixed by 1.8.7 and soon by 1.9.2 Regards, Thomas
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.