Date: Wed, 12 Sep 2012 13:49:46 -0400 From: Andrew Nacin <nacin@...dpress.org> To: Kurt Seifried <kseifried@...hat.com> Cc: oss-security@...ts.openwall.com, Hanno Boeck <hanno@...eck.de>, security@...dpress.org Subject: Re: CVEs for wordpress 3.4.2 release On Wed, Sep 12, 2012 at 1:04 PM, Kurt Seifried <kseifried@...hat.com> wrote: > On 09/12/2012 04:38 AM, Hanno Boeck wrote: > > I can't find CVEs assigend for the issues fixed in wordpress > > 3.4.2. > > > > http://wordpress.org/news/2012/09/wordpress-3-4-2/ > > > > > > Sadly, the information is quite limited: "Version 3.4.2 also fixes > > a few security issues and contains some security hardening. The > > vulnerabilities included potential privilege escalation and a bug > > that affects multisite installs with untrusted users. These issues > > were discovered and fixed by the WordPress security team." > > > > I suggest assigning two: 1. potential privilege escalation 2. > > problem with untrusted users on multisite installations unless > > someone has more information. > > Can security@...dpress.org provide clarification on this please? The second one there is CVE-2012-3383. 3.4.1 remained affected; fixed in 3.4.2. We are more specific on our version pages. From http://codex.wordpress.org/Version_3.4.2: * Fix unfiltered HTML capabilities in multisite (this is CVE-2012-3383) * Fix possible privilege escalation in the Atom Publishing Protocol endpoint * Allow operations on network plugins only through the network admin Details for the other two: * AtomPub allowed contributors to publish posts, which is normally reserved for users of an author role or higher. This should be considered low risk, low impact. An additional mitigating factor is that AtomPub is off by default and rarely enabled. (In WordPress 3.5, AtomPub will no longer be a part of core.) * For multisite, plugins that must be activated network-wide could be activated by a non-network administrator. This is only if they were already installed by a network administrator, but left inactive. This could also only occur if the network administrator allowed individual site administrators to manage plugins -- by default, this is not the case, and it is rare. Again, not particularly high risk or impact. Regards, Andrew Nacin Lead Developer WordPress
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ