Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 04 Jan 2011 11:12:54 +0100
From: Jan Lieskovsky <>
To: Mark Stosberg <>, Andy Armstrong <>
CC:, Marcela Maslanova <>,
        Petr Pisar <>,
        "Chris 'BinGOs' Williams" <>,
        Reed Loden <>,
        Masahiro Yamada <>,
        Byron Jones <>,
        Lincoln Stein <>,
        Tom spot Callaway <>
Subject: Re: Re: CVE Request -- perl-CGI two ids, perl-CGI-Simple
 one id (CVE-2010-3172 already assigned for Bugzilla part)

Hi Mark, Andy,

Ludwig Nussel wrote:
> Mark Stosberg wrote:
>> Yes, it is. However, later testing found that the issue wasn't
>> completely fixed in 3.50. A new patch has been developed, and is
>> currently pending review and acceptance by the primary author,
>> Lincoln Stein. (Now CC'ed).
> Any update on this? What are the remaining issues?

   Are there some patches to come yet wrt to Perl's CPAN CGI-Simple module
and those two CVE ids yet?

I can see latest CGi-Simple-v113 released on Monday, 27-th December 2010:

Does it contain fixes for both CVE issues (so it is possible to rebase to new
version) or anything else to be done in this part of the world yet?

Is the fix, we were waiting for on the CGI-Simple side:

or yet another one?

Thanks && Regards, Jan.
Jan iankko Lieskovsky / Red Hat Security Response Team

> cu
> Ludwig

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.