Date: Wed, 24 Apr 2013 13:17:54 -0400 (EDT) From: cve-assign@...re.org To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: CVE-2013-3221 can also relate to Microsoft SQL Server and IBM DB2 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 In the http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3221 entry, what we meant is that CVE-2013-3221 is exclusively about the behavior of Ruby on Rails as discussed in the listed MLIST:[rubyonrails-security] 20130207 reference. If a reference is about a data-type injection impact in an application other than a Ruby on Rails application, it should not be mapped to this CVE. However, an applicable reference about interaction between Ruby on Rails and Microsoft SQL Server (or interaction between Ruby on Rails and IBM DB2) should be mapped to this CVE. (There might be a misinterpretation that CVE-2013-3221 is only about interaction with MySQL. http://twitter.com/dakull/statuses/326633931636084736 possibly suggests that, but we're bringing this up mostly because of a comment that someone else sent directly to MITRE.) - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (SunOS) iQEcBAEBAgAGBQJReBIGAAoJEGvefgSNfHMdJpsH/1FRwadPMUtWImCMRTqpUY++ oc7mACrVbpBhbajI2ZmDayJJKq3BNJ9706ig/084icZ9ToPgiaxNIntVPhl4yLDb MrjJ+yx/lgg4BFrr8KcoOFCDqfZ1SNxKh4q/oA10cLqHzFVZ+MjcTEUXU5zJmfKX td+x2ITcs6gfOdqD8HHqYO2LKYpvaWkmciGBc+3EEeW0x2G57eKOd7YyHplhKHwK Sqar7R1oGL9swinJvgw10fwJlSKBpq0dmNGjHp/x3zj8J7LATzFNcXrhau6d/+/V a4fG0AC0GzEXGVscb9Os3Kdg7SD+tkHGuvEwLyEwp4Ay+NqGtsXT97RgpuWrTQY= =jViV -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ