Date: Tue, 10 Apr 2012 13:08:07 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Greg Knaddison <greg.knaddison@...uia.com> Subject: Re: CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 04/10/2012 10:30 AM, Greg Knaddison wrote: > I had a few questions/comments as I updated these - inline below: > > "NO CVE","SA-CONTRIB-2012-050","CDN2 Video - >> Unsupported","https://drupal.org/node/1506542" >> > > While the backend service and module are no longer active, there > are 70 sites using this module who are vulnerable to CSRF/XSS. What > is the reason not to give it a CVE? I was under the impression that if the backend was off the plugin wouldn't work/expose the vuln, I could of course be wrong, if so I'll assign a CVE. > >> "NO CVE","SA-CONTRIB-2012-056","Janrain Engage - Sensitive Data >> Protection Vulnerability","https://drupal.org/node/1515282" >> > > We debated a bit about this one and whether to make it an SA or > not. In the end we decided that if a module were persisting the > password in plain text that would deserve an SA so this one > (persisting a login token in plain text) should also get an SA. Do > you have any guidance on how you think we should have handled it? Well the CVE inclusion decisions: Pro assignment: Does exploitation of the issue provide the attacker with extra privileges or information, or cause a denial of service, that the attacker would not already have before they attempt to exploit the issue? Anti-assignment: Is the issue site-specific? Is it only in an online service (software-as-a-service), on a specific web site, or only offered through hosting solutions that are under the full control of the vendor? Does the issue only affect a version that was never made generally available to the vendor's customers? > If you have any further suggestions on how we can improve the > content or formatting of the SAs please let me know. Direct links to the code commits fixing them would be nice =) > Thanks, Greg > - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJPhIUXAAoJEBYNRVNeJnmTfGkP/3huqD45i6hpUn5QtkhmRH3L p/RpE2/muJIhyBFCYpTDQN4fqlt5TjHFLMCjDrm/be9h51mq54n4KNXLXGMPeax/ ZDqg0LzZiTW918R5+zfIOtsf/rvUziT3GpNyOTVjWdNDa5hCF+SOeBiylXBIGVwk z1rYhC5r37FO5dmfgjk1fVCnprbKDavJjLaDn3kiPpDyj+UFUgEyiif/iTn1zJGh UazjNE8gxWB8NaLodihFZHqSy9aEUmoRSy0EPqFlbKPWHZzNvs4ju2MWuBjn+S/t lebnnvXcknnTbpQM1fm5AkC6GiXxblxgcRsJPzz2moAqfHg1uRl7s5W3IoZnoPCY Vw86JUWlDvQG9JNR0i7fGFsfBCN9K0M+i1zIa8ZqKNDZr6fiFULFZP7270bsPoYd SIPQDBb25hbri8v6MpomHFUFQa55LI+/10kGPshTt1fyOJMLDHfbsrj2OtU5Iy/p ehTTQUyZpSMQr/NoBNFIpuxbtKoGjIb1+F+RjQXJsCoeqbX2WniUGXXcRhhjzDtd aJIwfv6Tg7j838IwZPiKQwjho8a0bew4TXjwEBIqKm4ljm/c8tL5j/8Dqs1EShqn VB+5iRZF9tIfShZJuASGZq9oapwxjQvgd+V8yzq68EiUfWqOHWF6r0Gyme1UVZUK sWGz+Vgf3GyJVKWx+s/5 =jemE -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.