[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 1 May 2014 15:00:25 -0400 (EDT)
From: cve-assign@...re.org
To: mmcallis@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com,
746322@...s.debian.org
Subject: Re: CVE request: Python Bottle JSON content-type not restrictive enough
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746322 and
> https://github.com/defnull/bottle/issues/616 report an issue where
> Bottle treated "text/plain;application/json" as JSON, allowing security
> mechanisms to be bypassed.
Use CVE-2014-3137.
The scope of this CVE does not include any behavior of Chrome that
could be interpreted as a Chrome vulnerability, e.g., "can make a
request with the content-type of text/plain;application/json (IMO this
is a bug in Chrome)" in 616. A later comment in 616 says "The original
reporter mentioned filing Chrome bugs." As suggested by the
http://www.google.com/about/appsecurity/ page, Chrome bugs are the
mechanism for getting CVE assignments from the Google CNA.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJTYpkXAAoJEKllVAevmvmsfl8IAI6ITpAf9TshVu0Y9+fC73zr
jCEwMs3qy53bs7ongjU0qQluH68sX4ckkobldhZL/2OM0oLPhz8ZSXNxNsHx9pX5
V7rhUgpHsM0BLyJSr2Zpr/aN/SbPKlqZWJjmLRlfslc0+BJdpqp0v7vvqjZS6iXa
BWsDcxLCQ3yMk4cYqXssfodjBKcForeOzCPlRnUrEEwE5zYMib+qkXD2vSNxDfdO
on0gFbun5+ldTm+DiN5nnkH7s6pYuPZRcmL2/BqHWfun1s9kPzCI9Vsfvf9kHJD8
LCN1e7N6S3h3Zulg+jmJSqTWJsu3aaNu+Bc4FgTBmzuYIsc0FXaPxRDE3bkmp08=
=iVci
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
