oss-security - Re: [security] CVE Request - SA-CORE-2013-001 (one JQuery X < 1.63 issue and two Drupal modules issues)

server OS

Message-ID: <CABbbngBf4DHCp6gP8Od_5K6s-Y-HFirAjNQ3HTex5Ca14X+Nnw@mail.gmail.com>
Date: Sun, 20 Jan 2013 21:39:22 -0800
From: Forest Monsen <forest.monsen@...il.com>
To: "security@...pal.org" <security@...pal.org>
Cc: Jan Lieskovsky <jlieskov@...hat.com>, oss-security@...ts.openwall.com, 
	"Steven M. Christey" <coley@...us.mitre.org>, Mitre CVE assign department <cve-assign@...re.org>
Subject: Re: [security] CVE Request - SA-CORE-2013-001 (one JQuery X < 1.63
 issue and two Drupal modules issues)

CVE assignment team: Please at least copy security@...pal.org when all four
CVE identifiers have been assigned, and we'll make sure they're publicly
attached to the vulnerabilities as usual. Thanks again to Jan for ferreting
out this issue.

Best,
Forest

On Fri, Jan 18, 2013 at 3:02 PM, Greg Knaddison <greg.knaddison@...il.com>wrote:

> Response below.
>
> On Thu, Jan 17, 2013 at 8:50 AM, Jan Lieskovsky <jlieskov@...hat.com>
> wrote:
> > @Drupal security team - could you clarify if to fix the first issue,
> > there was yet some other Drupal specific patch / change (besides the
> > JQuery library update), which would require yet another (fourth) CVE
> > id to be allocated?
>
> The fix we added to Drupal does not require (or implement) an update
> to the jQuery library at all; rather it works around the issue
> entirely within Drupal's code.  I think that means it should get its
> own CVE ID.
>
> We did it this way because it means that any other Drupal packages,
> such as drupal7-jquery_update, would not be expected to have a
> vulnerability as long as the core update is applied.
>
> I believe this means that yes, we will need a fourth CVE id to be
> allocated.
>
> Thanks,
> Greg
> --
> [ Security | http://lists.drupal.org/mailman/listinfo/security ]
> [Security team mailing list management and scheduling is documented here |
> https://security.drupal.org/handling-list-emails]
>