[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <513E95E1.2080304@redhat.com>
Date: Mon, 11 Mar 2013 20:41:37 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Adam Zabrocki <pi3@....com.pl>, full-disclosure@...ts.grok.org.uk,
secalert <secalert@...urityreason.pl>
Subject: Re: Multiple SQL Injection vulnerabilities in Disk
Pool Manager (DPM)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 03/10/2013 12:17 AM, Adam Zabrocki wrote:
> Name: Multiple SQL Injection vulnerabilities in
> Disk Pool Manager (DPM) Author: Adam Zabrocki
> (<pi3@....com.pl>) Date: November 27, 2009 (Yes,
> it's very old bug ;P)
>
> Timeline
>
> 2009-11-27 - Found vulnerability. 2011-08-03 - Vulnerability
> officialy reported. 2013-02-19 - Updated packages available in the
> EGI UMD-1 and EGI UMD-2. 2013-03-05 - Public disclosure on vendor's
> wiki, after allowing sites to upgrade
> (https://wiki.egi.eu/wiki/SVG:Advisory-SVG-2012-2683) 2013-03-10 -
> Release of this advisory.
>
>
>
> Best regards, Adam Zabrocki
>
> -- http://pi3.com.pl
I'm curious as to why the 2 year delay? I'm going to go with the date
reported as that is also mentioned in the public advisory, I can't
confirm the 2009 date.
Please use CVE-2011-4970 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRPpXhAAoJEBYNRVNeJnmTWM4QAIXbXji8kHSgx0HRpLSuOORM
EQvjEnKiu65WQxNnDsvde1PIqLMjblG+aKL1ui8lXzqqA1qWmgAKbamQ69BaSzMN
XF1mPsmb7xz+piwUfWUOCJZz/PbOmLBXyp6TRmxOvbne42DC6CBO5mRWmboYLC9k
an1qK3ymSMyf1WHmJGG+6b68WqfhtcH2Q/fKchn7KvpPHgU4+a4zmlmb587q1cf1
UVrMCwr6VWX2Jt/hLs3YP9Phb9DEGKQN/QorieNN9pPe1l5KM5/dB0HWtmD632t3
q44zY4J9cPNHsUcUgrD7iw0q0pYK5Jah72YZjEjPeK29hiBH6BsOtRWcrF5zfUKq
iVifcrNPsaQ2iDn+eU3BYbw/g4EUD3hlqhJ4gYfWUeZQXWfaxBM1wHOupHDQcLUo
GJZZgbpd3nE8rN0Wtc3ZbF0Ht8iv5JiI3ZC6ZXA/R7ff6KfQjeP5ncqkfehPLOYR
sH0arO/Nc/3ek4dtFDYiDCeO1gWNrzx4rZK+ajgtoqMN1zk8I4R5u/3dgmiDirsa
ZHhgcu8XLjBYx/4mmOO09H+ovNZZELGZnHg43HAdcjbG5piUUSB5DhUXYoBMN5QX
LEzBHmppsceuOe3LgbEtjbNX93+nk7Ch8JV8nj03AJo490HFpOUS670PF9nCPGfO
ZKSznOcQlQmvvqUILsaG
=SR7C
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
