Date: Tue, 31 Dec 2013 09:10:11 +0800 From: Steve Kenworthy <steveyken@...il.com> To: cve-assign@...re.org Cc: henri@...v.fi, oss-security@...ts.openwall.com, joernchen@...noelit.de Subject: Re: CVE request: Fat Free CRM multiple vulnerabilities Thanks for assigning. I can confirm for issue 3 that the disclosure also involves to_xml. Please assign the additional CVE ID. Re: denial of service, I don't believe this is an issue as the exploit only relates to read operations. On Sat, Dec 28, 2013 at 8:23 PM, <cve-assign@...re.org> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > http://www.phenoelit.org/stuff/ffcrm.txt > > http://seclists.org/fulldisclosure/2013/Dec/199 > > https://github.com/fatfreecrm/fat_free_crm/issues/300 > > > https://github.com/fatfreecrm/fat_free_crm/wiki/Fixing-security-vulnerabilities-%2827th-Dec-2013%29 > > > 1. Known Session Secret > > > https://github.com/fatfreecrm/fat_free_crm/commit/93c182dd4c6f3620b721d2a15ba6a6ecab5669df > > Use CVE-2013-7222. > > > > 2. Lack of CSRF Protection > > > https://github.com/fatfreecrm/fat_free_crm/commit/a7fedbb36388bad0c0f32b2346481e0ea126dea6 > > Use CVE-2013-7223. > > > > 3. Default to_json for models > > > https://github.com/fatfreecrm/fat_free_crm/commit/cf26a04b356ad2161c4c6160260eb870a3de5328 > > Use CVE-2013-7224. > > > > 4. Multiple SQL Injections > > > https://github.com/fatfreecrm/fat_free_crm/commit/078035f1ef73ed85285ac9d128c3c5f670cef066 > > > https://github.com/fatfreecrm/fat_free_crm/commit/d4b2de81a4d8c1b201482edcb2488ed9280a65fd > > Use CVE-2013-7225. > > For item 3: if there is an information-disclosure vulnerability > involving to_xml, please let us know and we can assign an additional > CVE ID. The joernchen advisory mentioned only to_json, and therefore > to_xml has a different discoverer and may require a separate CVE ID. > > If there is a denial of service issue involving :delete, please let us > know and we can assign an additional CVE ID. The joernchen advisory > mentioned only "renders JSON requests with a full JSON object," and > therefore :delete has a different discoverer and may require a > separate CVE ID. > > - -- > CVE assignment team, MITRE CVE Numbering Authority > M/S M300 > 202 Burlington Road, Bedford, MA 01730 USA > [ PGP key available through http://cve.mitre.org/cve/request_id.html ] > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.14 (SunOS) > > iQEcBAEBAgAGBQJSvsH6AAoJEKllVAevmvmsjksIAMeaH2HBfTrSNt83LAy1Sk0c > Q+lexLe6vIsOQLeh02/vk4zk/piqcuQGcmTmpEQ+X5lT+7zwrBoZAe3/g36Nb+mM > uJh9gBzsJkq0JUnqRVn84e9gxnJpqXjUB0aRRhaFrMBKB5jdTDFpWzKWS77KVzhI > QlgEMBObp4WUQHjAfsZcN+cs+xWjMVvR7+rk1AWJ9hAjT02UBGigVNWe5PmDrb8z > /yqcrQiEFTENbdQKSjNxlSSoEFWxEUF1b4PInNl7451ep0Ee2ZKoi9bte8h8pgsP > rOzEsPzu0yevLI7Wgrvl+clSdesuvIi6/2kGklv5LTsM23Rw/spat4nkAuFPKlU= > =PZmt > -----END PGP SIGNATURE----- >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.