[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1266257529.31647.38.camel@x300.fritz.box>
Date: Mon, 15 Feb 2010 19:12:09 +0100
From: Thomas Waldmann <tw-public@....de>
To: oss-security <oss-security@...ts.openwall.com>
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- MoinMoin -- 1.8.7
Hi,
sorry about being rather vague in what I told/tell about the issues, but
this is just to protect the vulnerable systems out there until fixes are
available and have been widely deployed (or at least every admin
interested in security had a chance).
All the recently discovered issues are basically just 2 issues (the
sys.argv issue in 1.9 and the other issue more or less in all moin
versions at different places in the code).
> Last message in:
> [7] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=569975#10
> suggests only the "superuser list" issue was fixed in 1.8.7
No, all known issues that affect 1.8 (and also all versions before) were
fixed in 1.8.7.
> and more fixes are about to come -- "<ThomasWaldmann>
> 1.9.2 planned in about 1 or 2 weeks".
1.9.2 will fix all known issues that affect 1.9.
The sys.argv issue was already fixed by 1.9.1.
BTW, we won't do a new 1.7.x release, but the fixes can be pulled from
the repo. Likely this is interesting for package maintainers who have to
support 1.7.x packages with security fixes. Users who just manually
downloaded and installed 1.7.x are advised to just do an easy upgrade to
1.8.7 (or even 1.9.2 soon, with a bit more work needed).
> what was fixed to know, how many CVE identifiers are needed / sufficient
> for MoinMoin of version v.1.8.7.
I am not very familiar with CVE stuff, but as there are 2 fundamental
problems that have been fixed, I guess 2 CVEs are right.
a) one CVE for the sys.argv issue in 1.9 that was fixed in 1.9.1
b) one CVE for the other kind of issues in all moin versions, fixed by
1.8.7 and soon by 1.9.2
Regards,
Thomas
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
