Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sat, 18 Oct 2014 20:44:08 +0200 (CEST)
From: Marcus Krause <>
Subject: Re: Re: CVE request: TYPO3-EXT-SA-2014-014 and


some information for clarification:

----- Original Message -----
> > TYPO3-EXT-SA-2014-015
> > [...]
> Use CVE-2014-8328.
> [...]
> This is within the scope of CVE because TYPO3 has published a Security
> Bulletin indicating that it's a vulnerability from their perspective.
> [...]
> As always, a vendor is allowed to announce this type of previously
> default intentional behavior as a vulnerability; it's just somewhat
> unusual to do so.

TYPO3 CMS Core already provides such update check. This is either triggered
manually or automatically on regular bases (cron like).

This works by retrieving a complete dataset of available third-party plugins
and their versions from infrastructure. Then a TYPO3 CMS installation
on its own determines whether an update is available. So the only information
is the request for such dataset file (exposing remote IP address).

An update check in an extension is unnecessary and not an expected behaviour;
especially when it reports additional environment data and communicates with 
third-party infrastructure.

Marcus Krause.

Member TYPO3 Security Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.