oss-security - Re: [security] Pending CVE assignments for SA-CORE-2014-006?

server OS

Message-ID: <CANae7MioQ6mPCwb_ggXVo7SnVoOyufyHqyaQBqzfOr+D5UkDxw@mail.gmail.com>
Date: Thu, 20 Nov 2014 11:30:05 -0500
From: Peter Wolanin <pwolanin@...il.com>
To: Security Team <security@...pal.org>
Cc: carnil@...ian.org, oss-security@...ts.openwall.com, gwolf@...lf.org, 
	team@...urity.debian.org, cve-assign@...re.org
Subject: Re: [security] Pending CVE assignments for SA-CORE-2014-006?

re: https://www.drupal.org/node/2378367

The phpass module for Drupal 6 contains the backport from Drupal 7 of
the code related to the DoS, CVE-2014-9016

Since it's identical code, should I use the same CVE number, or since
it's a contributed project, there will be a distinct one issued?

Thanks,

Peter Wolanin

On Thu, Nov 20, 2014 at 9:48 AM,  <cve-assign@...re.org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>> Session hijacking (Drupal 6 and 7)
>
> Use CVE-2014-9015.
>
>
>> Denial of service (Drupal 7 only)
>
> Use CVE-2014-9016.
>
> - --
> CVE assignment team, MITRE CVE Numbering Authority
> M/S M300
> 202 Burlington Road, Bedford, MA 01730 USA
> [ PGP key available through http://cve.mitre.org/cve/request_id.html ]
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.14 (SunOS)
>
> iQEcBAEBAgAGBQJUbf58AAoJEKllVAevmvms2qcIAItiBrXYCr3qbvFieEgqWdZT
> UX/Z+6TcS65VB2JrLKXDgMLArWIXRQWVT/1dORotEabeEhtgGbaBljyH4KsHDp8W
> cwxcbmB6hgUpbWax4Kgo5a0JMBshWYUKU8cxQVmLWuVjBzhgcveNfcBYKd66hLP4
> iLroECbXKmn27/LCrlumwskxIOmjBLkecCH4cu3UXZdK46GpuxMxbSWlSSdBC0XF
> E3Svx0GxpwZIRDAA8bUXgwnMUgJkeiER+vbmD7l0Ool2/961SIhHWDfbfFClW4Xv
> lFW0qqRJtT6JXcoi9NSZiMRRDawVwXHqmUqTA9Es3OBULJEzh6N2gehNt8fSPqg=
> =olvS
> -----END PGP SIGNATURE-----
> --
> [ Security | https://lists.drupal.org/mailman/listinfo/security ]
> [Security team mailing list management and scheduling is documented here | https://security.drupal.org/handling-list-emails]