[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20120608061734.GA32386@kludge.henri.nerv.fi>
Date: Fri, 8 Jun 2012 09:17:34 +0300
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: Piwik before 1.7
On Tue, May 08, 2012 at 10:44:46PM -0600, Kurt Seifried wrote:
> On 05/08/2012 03:03 AM, Hanno Böck wrote:
> > Hi,
> >
> > http://piwik.org/blog/2012/02/7775/
> >
> > Information is very rare: "We would like to thank the following
> > security researchers for their responsible disclosure of XSS &
> > click-jacking issues: Piotr Duszynski, Sergey Markov, Mauro
> > Gentile."
> >
> > I'd suggest assigning 3 CVEs with subjects like
> >
> > "Unknown XSS or clickjacking issue identified by Piotr Duszynski"
> > "Unknown XSS or clickjacking issue identified by Sergey Markov"
> > "Unknown XSS or clickjacking issue identified by Mauro Gentile"
>
>
> We would like to thank the following security researchers for their
> responsible disclosure of XSS & click-jacking issues: Piotr Duszynski,
> Sergey Markov, Mauro Gentile.
> Thank you for disclosing security issues to the Piwik team, ensuring a
> healthy and safe experience for the whole community!
>
> I can't find anything else. Can you send the code commits that address
> this?
>
>
> - --
> Kurt Seifried Red Hat Security Response Team (SRT)
> PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
After long email conversation with the vendor we are not getting any details from them. This http://dev.piwik.org/trac/changeset/5804 might be related as Nicob pointed out. Could we still assign CVE-identifiers for these three issues?
- Henri Salo
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
