Date: Sat, 18 Oct 2014 20:44:08 +0200 (CEST) From: Marcus Krause <marcus@...ec.info> To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: Re: Re: CVE request: TYPO3-EXT-SA-2014-014 and TYPO3-EXT-SA-2014-015 Dears, some information for clarification: ----- Original Message ----- > > TYPO3-EXT-SA-2014-015 > > [...] > > Use CVE-2014-8328. > [...] > This is within the scope of CVE because TYPO3 has published a Security > Bulletin indicating that it's a vulnerability from their perspective. > [...] > As always, a vendor is allowed to announce this type of previously > default intentional behavior as a vulnerability; it's just somewhat > unusual to do so. TYPO3 CMS Core already provides such update check. This is either triggered manually or automatically on regular bases (cron like). This works by retrieving a complete dataset of available third-party plugins and their versions from typo3.org infrastructure. Then a TYPO3 CMS installation on its own determines whether an update is available. So the only information is the request for such dataset file (exposing remote IP address). An update check in an extension is unnecessary and not an expected behaviour; especially when it reports additional environment data and communicates with third-party infrastructure. Regards, Marcus Krause. -- Member TYPO3 Security Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.