Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Tue, 22 Jul 2014 17:13:18 -0700
From: Christian Hammond <>
Subject: Re: CVE requests for Review Board

My apologies. We usually go through someone else for CVEs, and he directed us this time to contact this address. We’ll be more careful in the future.


- Christian

Christian Hammond -
Review Board -
Beanbag, Inc. -

On July 22, 2014 at 2:40:58 PM, ( wrote:

Hash: SHA1  

> July 22, 2014 - 2:07 AM  
> Review Board 1.7.27 and 2.0.3 security releases  

> One of the security vulnerabilities allowed an attacker to construct a  
> URL that would inject custom JavaScript into the page, which could  
> then be passed to a user, allowing the custom code to run in their  
> session.  

Use CVE-2014-5027.  

> The other vulnerability allowed users without access to a private  
> review request to construct a URL for accessing original or patched  
> files from the repository, if they knew the right series of database  
> IDs.  

Use CVE-2014-5028.  

(Incidentally, we're not sure whether the original request sent July 21  
was within the oss-security list charter. MITRE does not control the list  
charter, but  

says "List Content Guidelines ... Public security issues only please"  
whereas the original request said "two security vulnerabilities ...  
Neither are publicly disclosed." If you want a CVE ID for an  
undisclosed vulnerability in the future -- for example, because you  
want to include the CVE ID number when the entry first becomes public -- there  
are other options, such as sending the CVE request directly to instead.)  

- --  
CVE assignment team, MITRE CVE Numbering Authority  
M/S M300  
202 Burlington Road, Bedford, MA 01730 USA  
[ PGP key available through ]  
Version: GnuPG v1.4.14 (SunOS)  


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.