oss-security - Re: Re: CVE Request -- perl-CGI two ids, perl-CGI-Simple one id (CVE-2010-3172 already assigned for Bugzilla part)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4D22F2A6.2080604@redhat.com>
Date: Tue, 04 Jan 2011 11:12:54 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: Mark Stosberg <mark@...mersault.com>, Andy Armstrong <andy@...ten.net>
CC: oss-security@...ts.openwall.com, Marcela Maslanova <mmaslano@...hat.com>,
        Petr Pisar <ppisar@...hat.com>,
        "Chris 'BinGOs' Williams" <chris@...gosnet.co.uk>,
        Reed Loden <reed@...dloden.com>,
        Masahiro Yamada <masa141421356@...il.com>,
        Byron Jones <glob@...b.com.au>,
        Lincoln Stein <lincoln.stein@...il.com>,
        Tom spot Callaway <tcallawa@...hat.com>
Subject: Re: Re: CVE Request -- perl-CGI two ids, perl-CGI-Simple
 one id (CVE-2010-3172 already assigned for Bugzilla part)

Hi Mark, Andy,

Ludwig Nussel wrote:
> Mark Stosberg wrote:
>> Yes, it is. However, later testing found that the issue wasn't
>> completely fixed in 3.50. A new patch has been developed, and is
>> currently pending review and acceptance by the primary CGI.pm author,
>> Lincoln Stein. (Now CC'ed).
> 
> Any update on this? What are the remaining issues?

   Are there some patches to come yet wrt to Perl's CPAN CGI-Simple module
and those two CVE ids yet?

I can see latest CGi-Simple-v113 released on Monday, 27-th December 2010:
[1] http://search.cpan.org/dist/CGI-Simple/

Does it contain fixes for both CVE issues (so it is possible to rebase to new
version) or anything else to be done in this part of the world yet?

Is the fix, we were waiting for on the CGI-Simple side:
[2] https://github.com/AndyA/CGI--Simple/commit/5a861280ef524661105e132536ff7d1a9084941f

or yet another one?

Thanks && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

> 
> cu
> Ludwig
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.