[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <51F2CB9C.4040005@redhat.com>
Date: Fri, 26 Jul 2013 13:18:52 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Moritz Muehlenhoff <jmm@...ian.org>,
Andreas Nilsson <andreas.nilsson@...en.com>,
Florian <floriangaultier@...il.com>,
"A. Jesse Jiryu Davis" <jesse@...en.com>,
"Steven M. Christey" <coley@...re.org>
Subject: Re: CVE Request - MongoDB <=2.4.4 uninitialized object
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 07/18/2013 11:00 PM, Moritz Muehlenhoff wrote:
> On Thu, Jul 18, 2013 at 08:14:39AM -0400, Dan Pasette wrote:
>> We already requested CVE-2013-2132 for this and it was fixed in version
>> 2.4.5.
>>
>> We announced it on mongodb-announce and have it listed in our alerts page
>> here: http://www.mongodb.org/about/alerts/
>
> CVE-2013-2132 was already assigned to this issue in the Python driver:
> http://www.openwall.com/lists/oss-security/2013/05/31/6
> https://jira.mongodb.org/browse/PYTHON-532
> https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2132
>
> While "your" CVE-2013-2132 refers to
> https://jira.mongodb.org/browse/SERVER-9878, which AFAICS is a different
> issue.
>
> Cheers,
> Moritz
>
Can upstream please confirm/deny what is going on here, I'm pressed
for time recently and don't have time to wade through the code to
determine what's up, as I see it:
1) did a CVE number get recycled? E.g. you fixed the issue referred to
in CVE-2013-4142 in mongodb but then label it with CVE-2013-2132?
2) are these in fact in need of a CVE merge? (seems unlikely since one
is mongodb, and the other is the python driver, so different code bases)
3) some other option?
I guess my biggest concern right now is confirming that CVE-2013-4142
( http://blog.scrt.ch/2013/06/04/mongodb-rce-by-databasespraying/) is
in fact fixed in release 2.4.5 of mongoDB. Thanks!
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJR8sucAAoJEBYNRVNeJnmThyoP/1iLNar6Ebax4ini7ZsUIDOP
fQVtXD0H5soEMmaqtgVLvmpobvCmcKdk1Yx6GbARgvCiR9aRxODRr6uUHTqWYo8l
YkH7RHLXBNPfo31itzvF2psKkS0rcfhNw9eWIYkx7wbKd4eGSi64s/F8+A/Ewtql
7ZDo6lwxlmY8vEDaAo98Ts+Cavs0lF1EOFQ3z3nF6gDkZWKMER1R/WnZXnnop/j7
kc5xVWifdHJWkJOJ90wlhthZmyp+YijAMKINScPBv+/tgCZT5OKBM+7+VJFGKJLg
ZngwIcEkRRfqd/G9l+fQ1q6lMQPzKcFIIONeGSzIjxUay++uHBHUbxSS1A4YYwSW
VoOj7IZZ5BG+UZfG/Z8fQunG074W+QHKI8mx9XnmuZnZA9zo4MJ8PdvaVxhQE+mL
ACdOjBQQtHCyT46hOpPVE3RVXuFdzI3uDXaTN3YaWo63I03220vytr3gFkbT5Vv2
5+v2vE1wDQixXoH+92Y6fJkEoyk43s26BhEHrhvnKXzorxV7OUPvnIcOaWZR/JQA
cdetu9duQa3Kn95x0GS4OU/qE9CJ6WC+gsO90SD4p/8B9/6eARVZ+DzUaw798eaP
+X4SbvNu0+eUO85hMfGhDT3STrr8E7MzVTBYSn70QZduzA8FXpzM0p42h8KTbo8S
Cyp09K0HbsPMTte1nuNN
=qHRK
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
