oss-security - Re: Possible CVE Request: MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140802054756.GB25642@eldamar.local>
Date: Sat, 2 Aug 2014 07:47:56 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: Chris Steipp <csteipp@...imedia.org>
Cc: oss-security@...ts.openwall.com,
	CVE Assignments MITRE <cve-assign@...re.org>
Subject: Re: Possible CVE Request: MediaWiki Security and
 Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2

Hi Chris,

On Thu, Jul 31, 2014 at 01:17:33PM -0700, Chris Steipp wrote:
> On Thu, Jul 31, 2014 at 12:35 PM, Salvatore Bonaccorso
> <carnil@...ian.org> wrote:
> > Hi
> >
> > New Security and maintenance releases for mediawiki (1.19.18, 1.22.9
> > and 1.23.2) were released:
> >
> > http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html
> >
> > From the announcement, three SECURITY tagged bugs were fixed.
> >
> > Are CVE assignments for those already been requested, or if not, could
> > you assign CVEs for these?
> 
> None have been requested or assigned.

Thanks for feedback (btw. should have Cc'ed you in advance on
this request).

> * (bug 68187) SECURITY: Prepend jsonp callback with comment.
> ** This was hardening against CVE-2014-4671, I don't think CVEs are
> being assigned for these?

No strong opinion here. There was at last CVE-2014-1546 assigned in
bugzilla for this
(https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-1546). So a CVE
might also be assigned for this.

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.