oss-security - Re: CVE request: monitorix: HTTP server 'handle_request()' session fixation & XSS vulnerabilities

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 12 Dec 2013 00:20:14 -0500 (EST)
From: cve-assign@...re.org
To: ratulg@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: monitorix: HTTP server 'handle_request()' session fixation & XSS vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> https://github.com/mikaku/Monitorix/issues/30
> allowable characters in the $target and $target_cgi variables
> in lib/HTTPServer.pm

Use CVE-2013-7070.

Note that, at the moment, we think there isn't sufficient evidence
that "session fixation" in this context is an independent
vulnerability, and thus there is no CVE ID for that.


> http://www.monitorix.org/news.html also says "3.4.0 version
> released ... 02-Dec-2013 ... This version also fixes an important
> number of bugs and two security issues ... not covered yet in the
> previous 3.3.1 version."

For the XSS issue for the PATH_INFO (aka the $url variable), fixed in
3.4.0, use CVE-2013-7071.

For the other issue (the unspecified issue of the "two security
issues") fixed in 3.4.0, use CVE-2013-7072.

For the out-of-context reference to go.cgi in GoScript, use
CVE-2004-2776.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJSqUcEAAoJEKllVAevmvmswZAH/1leJqwAxCnc5u7RKLAWRzHB
88Gu/cWfoEdKPEidBENINQC/sctPkfXz6DEf7r6wtzbMfqtRANnB+GVra0dvDeTj
tkukvV6+QibUDzcIpuqOdEVTorFSF0Vf3bQg2czjJ4vDkPKjgTWz5DCjeBn508Pq
HE/veUJivmWj1xE+cux7muiuHZTpBO9t2IF6/18O2Fzhm0rlpfWWEZWF5UlpmZu0
o1NG+n80+KSSVhYVNczzjPpDEIxelLfcgTvlZWUuKwnOWG9VA4jgu0bBNBDOAHwJ
20o1APNWCWshOrgmvg8CRhneMvKAcQTjiKQDLCkjwFfwB3o/HHNBIusgqSEXG2w=
=f/e4
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.