Date: Mon, 5 Jan 2015 20:13:29 +0200 From: Henri Salo <henri@...v.fi> To: Korvin Szanto <Korvin@...tlandlabs.com> Cc: oss-security@...ts.openwall.com, Simo Ben youssef <simo@...xploit.com> Subject: Re: CVE request: Concrete5 XSS vulnerability -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Mon, Jan 05, 2015 at 09:56:24AM -0800, Korvin Szanto wrote: > This has been fixed in 5.7.3 for some time > https://github.com/concrete5/concrete5-5.7.0/commit/e3d47d2af88ddef36deaf754ef22f1f39b9b623b > > We have a security disclosure program for this so any disclosure > outside of our program is very irresponsible and unprofessional. You > end up with outdated information and leave us unable to fix the issue > in a secure way since we cannot see it until it's brought to our > attention through our disclosure program. Original advisory in http://seclists.org/bugtraq/2014/Dec/53 says following: """ Disclosure time-line 02 November 2014: Discovery. 03 November 2014: Initial report sent. 11 November 2014: Second contact. No response. 09 December 2014: Public disclosure. """ I do not know how author of that advisory tried to contact Concrete5. For future cases: https://www.concrete5.org/developers/security/ I only requested CVE for coordination purposes. In this case CVE is used to notify end-users to actually update their software so that they are not affected by this vulnerability. If you want more details please contact me off-list. Would it be possible for Concrete5 to request CVEs in the future as part of your security disclosure program? https://people.redhat.com/kseifrie/CVE-OpenSource-Request-HOWTO.html - -- Henri Salo -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iEYEARECAAYFAlSq1EkACgkQXf6hBi6kbk9o4ACeLhGKVeF1+JIMjrUVJMzIgDf4 CTMAn3QMFpwXw7ZBzUFS6Luv9euuIX6z =GYNG -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.