[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <8FC1EF7C-DB04-486D-B7DA-2F64666FB54C@stufft.io>
Date: Wed, 31 Jul 2013 04:25:49 -0400
From: Donald Stufft <donald@...fft.io>
To: kseifried@...hat.com
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE Request: Insecure Software Download in pip
On Jul 31, 2013, at 4:11 AM, Kurt Seifried <kseifried@...hat.com> wrote:
> Signed PGP part
>
> Ok I have no info on that CVE, is it embargoed? I can't find it in
> google after a quick search. I need to see that one before I can
> assign anything. As for the reserved thing:
>
> http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures#Description
>
If it's embargo'd it's news to me. The details (I assume) are here https://bugzilla.redhat.com/show_bug.cgi?id=968059
As far as I know none of the pip maintainers requested it. I assume (going by the bugzilla) that CVE is for the fact pip didn't use TLS or any other authentication method when downloading from the central index. That was fixed in 1.3 which was releases March 2013.
I don't know who "owns" that CVE or anything about it. The only reason I even know it exists is the red hat page showed up in a google search when I was looking for pip CVE's to match fixes up to. I'm not sure what I can (if anything?) do as a pip developer to unreserve it?
-----------------
Donald Stufft
PGP: 0x6E3CBCE93372DCFA // 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA
Content of type "text/html" skipped
Download attachment "signature.asc" of type "application/pgp-signature" (802 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
