Date: Sun, 13 May 2012 11:19:38 +0300 From: Henri Salo <henri@...v.fi> To: oss-security@...ts.openwall.com Cc: Matthieu Aubry <matthieu.aubry@...il.com> Subject: Re: CVE request: Piwik before 1.7 On Tue, May 08, 2012 at 10:44:46PM -0600, Kurt Seifried wrote: > On 05/08/2012 03:03 AM, Hanno Böck wrote: > > Hi, > > > > http://piwik.org/blog/2012/02/7775/ > > > > Information is very rare: "We would like to thank the following > > security researchers for their responsible disclosure of XSS & > > click-jacking issues: Piotr Duszynski, Sergey Markov, Mauro > > Gentile." > > > > I'd suggest assigning 3 CVEs with subjects like > > > > "Unknown XSS or clickjacking issue identified by Piotr Duszynski" > > "Unknown XSS or clickjacking issue identified by Sergey Markov" > > "Unknown XSS or clickjacking issue identified by Mauro Gentile" > > > We would like to thank the following security researchers for their > responsible disclosure of XSS & click-jacking issues: Piotr Duszynski, > Sergey Markov, Mauro Gentile. > Thank you for disclosing security issues to the Piwik team, ensuring a > healthy and safe experience for the whole community! > > I can't find anything else. Can you send the code commits that address > this? > > > - -- > Kurt Seifried Red Hat Security Response Team (SRT) I requested more details from security@ and got following reply from Matthieu Aubry: """ Hi Henri, I agree it sounds like a good idea to describe exactly what went wrong, in a spirit of openness and learning from mistakes. however, Piwik data is very sensitive. Many Piwik users don't upgrade and use older vulnerable version, sometimes data leaking are possible. If we give the details, first of all it takes time and energy which is already 100% booked, and secondly it would help black hat write bots to scrape and do bad. This is not a good investment of our time sorry... but I appreciate your work :) Matt """ I do not think this is good way to improve security. In my opinion these issues still need CVE-identifiers, but details will limit to "unknown XSS" etc. Does these get three or one CVE-identifier? - Henri Salo
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.