[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <1353327014.45829916.1413657848837.JavaMail.zimbra@t3sec.info>
Date: Sat, 18 Oct 2014 20:44:08 +0200 (CEST)
From: Marcus Krause <marcus@...ec.info>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: Re: CVE request: TYPO3-EXT-SA-2014-014 and
TYPO3-EXT-SA-2014-015
Dears,
some information for clarification:
----- Original Message -----
> > TYPO3-EXT-SA-2014-015
> > [...]
>
> Use CVE-2014-8328.
> [...]
> This is within the scope of CVE because TYPO3 has published a Security
> Bulletin indicating that it's a vulnerability from their perspective.
> [...]
> As always, a vendor is allowed to announce this type of previously
> default intentional behavior as a vulnerability; it's just somewhat
> unusual to do so.
TYPO3 CMS Core already provides such update check. This is either triggered
manually or automatically on regular bases (cron like).
This works by retrieving a complete dataset of available third-party plugins
and their versions from typo3.org infrastructure. Then a TYPO3 CMS installation
on its own determines whether an update is available. So the only information
is the request for such dataset file (exposing remote IP address).
An update check in an extension is unnecessary and not an expected behaviour;
especially when it reports additional environment data and communicates with
third-party infrastructure.
Regards,
Marcus Krause.
--
Member TYPO3 Security Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
