[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1005061359320.1759@faron.mitre.org>
Date: Thu, 6 May 2010 14:11:48 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: dan.j.rosenberg@...il.com
Subject: Re: CVE request: lxr
On Mon, 3 May 2010, Henri Salo wrote:
> On Mon, 3 May 2010 09:31:16 -0400
> Dan Rosenberg <dan.j.rosenberg@...il.com> wrote:
>
> Several XSS-vulnerabilities can have one CVE at least when those
> vulnerabilities are fixed at the same time.
Another factor is when they are published at the same time.
> Can someone verify what is the policy by the book?
It's never as easy as just a couple rules, unfortunately. In this case,
CVE-2009-4497 has been around for a long time, so it's strongly attached
to *only* the "i" parameter/ident issue. It's too risky to change the
fundamental meaning of a CVE after it's been published. (So even though
the intention of Dan's original request may have been to cover other
issues, that's not what it looks like to the public any more.)
Josh assigned CVE-2010-1448 for the search page issue, and now Dan has
alluded to a third issue that is neither ident nor search page, but we
don't know what that third issue is.
If Dan's issue is what he calls "a third XSS bug" in
http://www.openwall.com/lists/oss-security/2010/05/03/7 then I'd want a
different CVE for it - since it's addressed in a separate "version" than
the other two XSS bugs.
The crux of the problem here is that the original bug report alluded to
"several" XSS but only listed the ident issue; our CVE description
typically might say "multiple XSS, for example this particular vector,"
but we didn't do that... and neither does the vendor specifically indicate
that the other vaguely-specified issues were actually addressed.
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
