Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 28 Nov 2012 18:13:42 +0100
From: Ricardo Mones <ricardo@...es.org>
To: Vincent Danen <vdanen@...hat.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE request -- vCalendar plugin for Claws Mail:
 credentials exposed on interface

  Hi Vincent,

On Wed, Nov 28, 2012 at 09:44:53AM -0700, Vincent Danen wrote:
> * [2012-11-15 13:36:13 +0100] Ricardo Mones wrote:
> 
> > This has been reported on our bugzilla:
> > http://www.thewildbeast.co.uk/claws-mail/bugzilla/show_bug.cgi?id=2782
> >
> > There's still not fix available. Could a CVE id be allocated for this if
> >appropriate?
> >
> > thanks in advance,
> >
> >P.S.: I'm not subscribed to the list.
> 
> I don't know if this ever got a CVE or not; if it did I don't see a
> reference.
> 
> Also, according to this bug report it's fixed, but I can't find the
> patch in your CVS tracker.  Can you provide a link to it?

  Unfortunately tracker only tracks changes to core, not to plugins, but
the patch it's commited also into the Debian packaging, so this link may
serve:

http://anonscm.debian.org/gitweb/?p=users/mones/claws-mail-extra-plugins.git;a=commitdiff;h=a3f91d21b32dd0b63b28ccb0c6f7a73939b14c9a

> And, if a CVE hasn't been assigned, perhaps Kurt or someone could assign
> one?

  It't got one, but seems the list was not included in recipients:

> Please use CVE-2012-5527 for this issue.

  regards,
-- 
  Ricardo Mones 
  ~
  00:45 < hammar> cool.. have you used rssyl?                          
  00:46 <@Ticho> um, yes                            Seen on #sylpheed


Download attachment "signature.asc" of type "application/pgp-signature" (199 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.