Date: Thu, 6 May 2010 14:11:48 -0400 (EDT) From: "Steven M. Christey" <coley@...us.mitre.org> To: oss-security@...ts.openwall.com cc: dan.j.rosenberg@...il.com Subject: Re: CVE request: lxr On Mon, 3 May 2010, Henri Salo wrote: > On Mon, 3 May 2010 09:31:16 -0400 > Dan Rosenberg <dan.j.rosenberg@...il.com> wrote: > > Several XSS-vulnerabilities can have one CVE at least when those > vulnerabilities are fixed at the same time. Another factor is when they are published at the same time. > Can someone verify what is the policy by the book? It's never as easy as just a couple rules, unfortunately. In this case, CVE-2009-4497 has been around for a long time, so it's strongly attached to *only* the "i" parameter/ident issue. It's too risky to change the fundamental meaning of a CVE after it's been published. (So even though the intention of Dan's original request may have been to cover other issues, that's not what it looks like to the public any more.) Josh assigned CVE-2010-1448 for the search page issue, and now Dan has alluded to a third issue that is neither ident nor search page, but we don't know what that third issue is. If Dan's issue is what he calls "a third XSS bug" in http://www.openwall.com/lists/oss-security/2010/05/03/7 then I'd want a different CVE for it - since it's addressed in a separate "version" than the other two XSS bugs. The crux of the problem here is that the original bug report alluded to "several" XSS but only listed the ident issue; our CVE description typically might say "multiple XSS, for example this particular vector," but we didn't do that... and neither does the vendor specifically indicate that the other vaguely-specified issues were actually addressed. - Steve
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.