Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Tue, 24 Sep 2013 15:34:20 -0700
From: Seth Arnold <>
Subject: graphite CVE-2013-5903 confusion

Hello, I'm looking at CVE-2013-5903 from graphite and I believe there has
been a problem in how it has been applied.

The description from NVD and OSVDB says the vulnerability is cross-site

    Cross-site scripting (XSS) vulnerability in Graphite before 0.9.11
    allows remote attackers to inject arbitrary web script or HTML via
    unspecified vectors.

    Graphite contains a flaw that allows a remote cross-site scripting
    (XSS) attack. This flaw exists because the application does not
    validate certain unspecified input before returning it to the user.
    This may allow an attacker to create a specially crafted request
    that would execute arbitrary script code in a user's browser within
    the trust relationship between their browser and the server.

However, the checkins from the project appear to use this CVE for unsafe
use of Python's pickle module:

    This release contains several security fixes for cross-site scripting
    (XSS) as well as a fix for a remote-execution exploit in graphite-web


    Fix insecure deserialization of pickled objects (CVE-2013-5093)

MITRE, please advise.


Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.