oss-security - graphite CVE-2013-5903 confusion

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130924223420.GA12465@hunt>
Date: Tue, 24 Sep 2013 15:34:20 -0700
From: Seth Arnold <seth.arnold@...onical.com>
To: cve-assign@...re.org, oss-security@...ts.openwall.com
Cc: security@...ntu.com
Subject: graphite CVE-2013-5903 confusion

Hello, I'm looking at CVE-2013-5903 from graphite and I believe there has
been a problem in how it has been applied.

The description from NVD and OSVDB says the vulnerability is cross-site
scripting:

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-5903

    Cross-site scripting (XSS) vulnerability in Graphite before 0.9.11
    allows remote attackers to inject arbitrary web script or HTML via
    unspecified vectors.

http://osvdb.org/show/osvdb/97602

    Graphite contains a flaw that allows a remote cross-site scripting
    (XSS) attack. This flaw exists because the application does not
    validate certain unspecified input before returning it to the user.
    This may allow an attacker to create a specially crafted request
    that would execute arbitrary script code in a user's browser within
    the trust relationship between their browser and the server.


However, the checkins from the project appear to use this CVE for unsafe
use of Python's pickle module:

https://github.com/graphite-project/graphite-web/blob/master/docs/releases/0_9_11.rst

    This release contains several security fixes for cross-site scripting
    (XSS) as well as a fix for a remote-execution exploit in graphite-web
    (CVE-2013-5903).

    ...

    Fix insecure deserialization of pickled objects (CVE-2013-5093)


MITRE, please advise.

Thanks

Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.