Date: Fri, 28 Nov 2014 15:36:27 -0500 (EST) From: cve-assign@...re.org To: covener@...il.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE Request: "LuaAuthzProvider" in Apache HTTP Server mixes up arguments -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > https://issues.apache.org/bugzilla/show_bug.cgi?id=57204 We're not sure that this crosses privilege boundaries. http://httpd.apache.org/docs/2.4/mod/mod_lua.html#luaauthzprovider says Context: server config Apparently you're trying to use it in a directory context and finding that it doesn't work correctly. At least in theory, this could have been resolved by reporting an error when LuaAuthzProvider is found in a directory context, rather than by using the actual https://issues.apache.org/bugzilla/show_bug.cgi?id=57204#c2 approach to add the functionality. So, it may be reasonable to interpret this as a non-security bug that occurs when an administrator intentionally enters httpd.conf content that is, according to the documentation, invalid. We notice that https://issues.apache.org/bugzilla/show_bug.cgi?id=57204#c4 says "waiting to see if a CVE should be assigned." The usual process for CVE assignments for Apache Software Foundation products is: http://www.apache.org/security/committers.html Here, we realize that the issue was sent directly to the oss-security list, but MITRE doesn't have enough information to make a final decision. The Apache Software Foundation can decide whether the erroneous LuaAuthzProvider handling is a vulnerability from the perspective of their security policy. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJUeNxsAAoJEKllVAevmvmsk0EH/jbz+IQmwX2D+htr3yIdS77p Wk2jlSG+qjJC1it4YLlYR/lbKkRub6V4w7asFslw0oP0+Ex+PcGlO661ucTxHcIi CGFhiWNXXq6XhiY1027hhcEvJ2rKGWmsctmN1XmqR2OlGPtSicrKVYLuujLQOJsE fvFDVYbEhXQzw+PEfSgTXBBEUbqiVAJp6r6xyJKyiwd1hf3EumSI80g4x1xKPaEc CKYv9SmSvGs5VOTueEsZuMgQPUv0/Q7ED9FmVlNhl5sZKMA2SuWX1wzsa1zSu1eL 6DGWoHJoP4+WFQeRxCxZa+bdskf7P3joGJ/GwrJfDYYX46x4y9wi+lTB7I1piow= =cmIE -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.