Date: Fri, 24 Aug 2012 12:10:59 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Thomas Pollet <thomas.pollet@...il.com> Subject: Re: zenoss issues -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 08/24/2012 11:15 AM, Kurt Seifried wrote: > On 08/24/2012 01:33 AM, Thomas Pollet wrote: >> Hello, > >> I have found xss and command execution problems with zenoss. I >> created a bugreport which can be found at >> http://jira.zenoss.com/jira/browse/ZEN-3183 . However the zenoss >> developers don't seem to be able to reproduce the issues. > >> Another issue, reported by Emanuel Bronshtein can be found at >> http://jira.zenoss.com/jira/browse/ZEN-3153 > >> Regards, Thomas Pollet > > I can't access this page, it requires a login. Is there a public > resource you can reference, or can you get this page made public so > it can be referenced? Just to be clear I am unwilling (and unable) to accept reference links for OpenSource related CVE assignments that require: 1) a login (it's highly annoying and leads to points 2 and 3), this also breaks automated tools that download related links in the CVE database, not cool. 2) click through agreements (often required for logins) 3) acceptance of restrictive forms of legal agreements (e.g. NDAs) You need to source public information that is easily accessible and can be downloaded without significant human intervention (like creating an account). - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQIcBAEBAgAGBQJQN8OzAAoJEBYNRVNeJnmTcwYP/RWEdT93aa8w0TfxO6thbx5z HEvrA/pknIqPhu+qzoR5J4x8fnOkE10l2IMeGnf4rh45hx8YGgF6Cz4esgkYSBTd WIH+Ebm7fiMtcGICqYXNWh80/AdtcjfUmIKZlodg+u2QjLfbZWhzz0N+5mkYE4iR YmFKox8lRucXGRCo/6wtZ4O2xR/sOzHsh2iwHNTVSbOuzaxhLmFSz7+yPqX6lwZB rLfBQp6uBAYZohPFFbmfGRtlo6JhEZPeE1zlLA9RMLq2gt20+fzweTTbDLR5kBpY DyrpyU5j36HOgdb18zB1PezugZki5AHyKA+pl5tz4nAcuNQTTmzhma/8G6W4mfKP Xik5clFxxHNSIoVp+u5cZRRMXS9QmYGgKv7sMDKDkic2eGYqxyCrglJqPnbzRcm2 b18nyDK6vaLAxnbu5TWuSVoHw4g8VK3GLJHy0CJjLP2gzDpio+s3RGDSS1wTk+F7 ++T92vNJJEH3z3/krsbIto9uE9z2ql3FrQomYD+5yrfB3/P/ONMP8xhSIiz7Tk8C 9Qm2/BgfNDOExRuhgwfHVwzaxqG18OAPQmoJnDyRqPfy8cKiWa4OA/ZgRz/zYuyg MVVk+jl18thGoQoZ6S4MYy8fsbxNPaapmuWQOdzWqFtHr+wMOtZKFZOupYYtBxp4 cwX15jb3qlOjxEcdg2nX =O2cE -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.