Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 8 Aug 2013 14:16:39 -0600
From: Vincent Danen <>
Cc: Paul Gevers <>, Gandalf <>
Subject: Re: CVE Request: Regression introduced in cacti with
 fix for CVE-2013-1435

* [2013-08-08 21:20:59 +0200] Salvatore Bonaccorso wrote:

>Hi Kurt
>The fix for CVE-2013-1435[1] introduced a regression:
> [1]
>It was reported in [2] and upstream proposed a fix [3] which was
>confirmed to work by two of the involved people.
> [2]
> [3]
>The corresponding svn commits should be the following:
> [4]
> [5]
> [6]
>Does this need a follow-up CVE assignment for the regression part

My understanding would be no.  A follow-up CVE would be assigned if it
a) didn't fix the underlying security issue (it does) or b) introduced a
new security issue (it doesn't).

Botching the fix so that _functionality_ no longer works would not be
grounds for another CVE (although anyone backporting these would surely
want the additional fixes).

Vincent Danen / Red Hat Security Response Team 

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.