[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201407160557.s6G5vRgO026324@linus.mitre.org>
Date: Wed, 16 Jul 2014 01:57:27 -0400 (EDT)
From: cve-assign@...re.org
To: gmollett@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com,
kseifried@...hat.com
Subject: Re: CVE request - Snoopy incomplete fix for CVE-2008-4796
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The information that has been sent so far doesn't determine whether
there should be one CVE ID or two CVE IDs. A statement of "does still
allow command injection" would potentially mean two CVE IDs, whereas
"may still allow command injection" could end up as "does not still
allow command injection."
The original CVE request was on July 9, and implied that watching
http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log
was of interest because a second security fix might be announced there
"shortly." However, that view=log page was last updated on July 8. We
will continue to check that view=log page from time to time.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJTxhOyAAoJEKllVAevmvmsp8QIAItfZ1ZI8+5gPL7F3VRfqgFp
6WJI7sdYZ5bXKyvCpk3cr0oP6gijFRtfQITFKjj8LzbKDbwRxK6n3iC0+9FKWnYH
84AHQYcTHMCy6YOVF36VH9hFgrz1Z5lAJ1xlZpA3Vb7cuR5NrkJ914ZMBs7ULcp5
K+YqSpsexYYJdNBsHcpzMRCHzir4fXLtpdMhJg+rTguaSwitrAC/ezIgDVSmkupj
rOmF0JcX7BrPvdc1mKoNJPE6sLSOQ3u5YQ1QMHMFUYzmzmyLfJiiYqWMyyIinXme
UTu9gHVJsvxjfrz+Ti748NccKSYhDAQCTdLYJdHcgPfTVLL+PNIXFohkJoZCCwo=
=np9G
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
