Date: Thu, 21 Feb 2013 00:28:11 +0000 From: "Christey, Steven M." <coley@...re.org> To: Kurt Seifried <kseifried@...hat.com>, "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> Subject: RE: RE: Handling CVEs for the XML entity expansion issues Kurt, This is a big and complicated scenario. I will *privately* send you the draft that I'm working on right now. Sorry to the rest of the list - but the combination of new vuln types, "DoS" debates, libraries, and missing details have all combined to make this rather complicated. We will post something that should help address these specific situations, and others in the foreseeable future. I hope to do this within 24 hours. - Steve -----Original Message----- From: Kurt Seifried [mailto:kseifried@...hat.com] Sent: Wednesday, February 20, 2013 7:25 PM To: oss-security@...ts.openwall.com Cc: Christey, Steven M. Subject: Re: [oss-security] RE: Handling CVEs for the XML entity expansion issues -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 02/20/2013 06:02 AM, Christey, Steven M. wrote: > Kurt, > > I'm reviewing this issue with the rest of the cve-assign team. We > will get back to you with an answer shortly. > > - Steve Any movement on this? I'm now sitting on a huge pile of stuff that will need CVEs. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBAgAGBQJRJWlvAAoJEBYNRVNeJnmTRwcP/25newzMZJMtWV8PEm+3b4Sm bNdnDAQjbP82V7RBBqVQ/MlPHs9dFFXSwzZzjrHigT/lT/pe7db6oK4g75uL1+Y9 BSHuLK5OziJPLOczc/1YUZ17sk6+YzvubBCZQ1wzZ/OxcENYHtJ8h5g7ljFLpT9S wkg8vAMdaGZ+tA30kfyfEwiswp/a2we4AN3MwmV2e2WYnMmkBuWxO8xKkpjrKtO/ iK2ZlQV+WNVDelujpWMOfwJkCuHo66VZsgs/sC1g7DTPaG67ceboK8UVuY7q0vw1 vGkwHKQcclCOZjnUfLbgFXY/DWpWRi713brS9oTQUVV7JNTvnem1OjnzaJn4JOoa IS8RLi1XwYbMd7IYkreng+XODuf7+qZ9gTD/otDDjqSxX3ahq7Vnk7KDvXVgthJ4 tcUo9nlhKI34FY8wTwECs+CyVdluK42zOpa0Lx2dBK9kf4VE4ZlH+0qTzJl+5H0h rh+xzi2MOgs1cM2qUYSAiHRDsoOS0648xXcxe7vTR4m1eeHk/WF6z3umcXQ8yKSq RAFNvdpXnnLQZVNqUbl1dJG+hjHKf9klOWdPH6eDWn1PKv5G3RRMMmBviGIHPAUS DMl8RSu2VpzV0muqmeuSUSGrCS+SZPN/43CiGfClUVj0nNXmTw+28+8Ku/nQGNtM ldp8ePKKDs4yYbKe99Rt =uieQ -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.