[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <FC72FC641B949240B947AC6F1F83FBAF06980649@IMCMBX01.MITRE.ORG>
Date: Thu, 21 Feb 2013 00:28:11 +0000
From: "Christey, Steven M." <coley@...re.org>
To: Kurt Seifried <kseifried@...hat.com>, "oss-security@...ts.openwall.com"
<oss-security@...ts.openwall.com>
Subject: RE: RE: Handling CVEs for the XML entity expansion
issues
Kurt,
This is a big and complicated scenario. I will *privately* send you the draft that I'm working on right now.
Sorry to the rest of the list - but the combination of new vuln types, "DoS" debates, libraries, and missing details have all combined to make this rather complicated. We will post something that should help address these specific situations, and others in the foreseeable future. I hope to do this within 24 hours.
- Steve
-----Original Message-----
From: Kurt Seifried [mailto:kseifried@...hat.com]
Sent: Wednesday, February 20, 2013 7:25 PM
To: oss-security@...ts.openwall.com
Cc: Christey, Steven M.
Subject: Re: [oss-security] RE: Handling CVEs for the XML entity expansion issues
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 02/20/2013 06:02 AM, Christey, Steven M. wrote:
> Kurt,
>
> I'm reviewing this issue with the rest of the cve-assign team. We
> will get back to you with an answer shortly.
>
> - Steve
Any movement on this? I'm now sitting on a huge pile of stuff that
will need CVEs.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRJWlvAAoJEBYNRVNeJnmTRwcP/25newzMZJMtWV8PEm+3b4Sm
bNdnDAQjbP82V7RBBqVQ/MlPHs9dFFXSwzZzjrHigT/lT/pe7db6oK4g75uL1+Y9
BSHuLK5OziJPLOczc/1YUZ17sk6+YzvubBCZQ1wzZ/OxcENYHtJ8h5g7ljFLpT9S
wkg8vAMdaGZ+tA30kfyfEwiswp/a2we4AN3MwmV2e2WYnMmkBuWxO8xKkpjrKtO/
iK2ZlQV+WNVDelujpWMOfwJkCuHo66VZsgs/sC1g7DTPaG67ceboK8UVuY7q0vw1
vGkwHKQcclCOZjnUfLbgFXY/DWpWRi713brS9oTQUVV7JNTvnem1OjnzaJn4JOoa
IS8RLi1XwYbMd7IYkreng+XODuf7+qZ9gTD/otDDjqSxX3ahq7Vnk7KDvXVgthJ4
tcUo9nlhKI34FY8wTwECs+CyVdluK42zOpa0Lx2dBK9kf4VE4ZlH+0qTzJl+5H0h
rh+xzi2MOgs1cM2qUYSAiHRDsoOS0648xXcxe7vTR4m1eeHk/WF6z3umcXQ8yKSq
RAFNvdpXnnLQZVNqUbl1dJG+hjHKf9klOWdPH6eDWn1PKv5G3RRMMmBviGIHPAUS
DMl8RSu2VpzV0muqmeuSUSGrCS+SZPN/43CiGfClUVj0nNXmTw+28+8Ku/nQGNtM
ldp8ePKKDs4yYbKe99Rt
=uieQ
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
