[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20140929154431.86A9C72E0E6@smtpvbsrv1.mitre.org>
Date: Mon, 29 Sep 2014 11:44:31 -0400 (EDT)
From: cve-assign@...re.org
To: jwilk@...lk.net
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, chet.ramey@...e.edu
Subject: Re: Fwd: Non-upstream patches for bash
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> the parser is not locale-agnostic. Here's an example how it can be
> exploited:
> http://bugs.python.org/issue22187
The discussion in Issue22187 is about changing code in Python 2.x to
work around this. However, is it useful to assign one new
CVE-2014-#### ID for Bash, on the expectation that Bash was intended
to recognize valid characters in zh_CN.GBK, but instead is identifying
part of a two-byte character as a \ character, and this has security
implications for products that attempt to do otherwise-correct quoting
of untrusted strings for use in sh commands?
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJUKX02AAoJEKllVAevmvms7lgH/2dhMdR3o/zLU2015e3AZOrh
K2QOtr+BqH2vOsE/x98LZMtBYra+E3JysBJkqSxZcsSnr0FqBzGu08aB8ETMgrx5
DtaIeCTP7GM3T0zGCuX8dabCnAoQct0VuDSGOYCRCgf7lF1MUxC7RDT/8DbB/woO
4V1IbBBAfYVQicgvEmnkZUkhbhziC/9s1HeEFBwNldTDknV5HTVrHdlv0Y4y0/Bd
00LbClq+LPdqJ5/nspegWQ50d6e2ZksUBM4ahag3qxeWcT28om4yJ7Zm0eJ0D5BZ
Xy3sc5j5ks/WDkna12JH+cFqd1snVuLE8POSHh0aOWf53Tla/zFCj9E3gwwUlVw=
=j7/e
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
