Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Wed, 24 Apr 2013 13:17:54 -0400 (EDT)
From: cve-assign@...re.org
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: CVE-2013-3221 can also relate to Microsoft SQL Server and IBM DB2

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

In the http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3221
entry, what we meant is that CVE-2013-3221 is exclusively about the
behavior of Ruby on Rails as discussed in the listed
MLIST:[rubyonrails-security] 20130207 reference. If a reference is
about a data-type injection impact in an application other than a Ruby
on Rails application, it should not be mapped to this CVE. However, an
applicable reference about interaction between Ruby on Rails and
Microsoft SQL Server (or interaction between Ruby on Rails and IBM
DB2) should be mapped to this CVE.

(There might be a misinterpretation that CVE-2013-3221 is only about
interaction with MySQL.
http://twitter.com/dakull/statuses/326633931636084736 possibly
suggests that, but we're bringing this up mostly because of a comment
that someone else sent directly to MITRE.)

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (SunOS)

iQEcBAEBAgAGBQJReBIGAAoJEGvefgSNfHMdJpsH/1FRwadPMUtWImCMRTqpUY++
oc7mACrVbpBhbajI2ZmDayJJKq3BNJ9706ig/084icZ9ToPgiaxNIntVPhl4yLDb
MrjJ+yx/lgg4BFrr8KcoOFCDqfZ1SNxKh4q/oA10cLqHzFVZ+MjcTEUXU5zJmfKX
td+x2ITcs6gfOdqD8HHqYO2LKYpvaWkmciGBc+3EEeW0x2G57eKOd7YyHplhKHwK
Sqar7R1oGL9swinJvgw10fwJlSKBpq0dmNGjHp/x3zj8J7LATzFNcXrhau6d/+/V
a4fG0AC0GzEXGVscb9Os3Kdg7SD+tkHGuvEwLyEwp4Ay+NqGtsXT97RgpuWrTQY=
=jViV
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ