[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20150522124247.65E976C005F@smtpvmsrv1.mitre.org>
Date: Fri, 22 May 2015 08:42:47 -0400 (EDT)
From: cve-assign@...re.org
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: CVE request: Multiple SQL injection vulnerabilities in GigPress - WordPress plugins.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> Multiple SQL injection vulnerabilities in GigPress (WordPress plugin)
> I request a CVE for the same.
Yes, MITRE is able to provide a CVE ID. (We will do this soon,
regardless of the outcome below.)
What apparently occurred in the previous case this week was that the
WordPress plugin changelog URL was sent here, then the CVE ID was sent
here, and then the CVE ID was used on fulldisclosure, i.e.,
http://openwall.com/lists/oss-security/2015/05/18/8
http://openwall.com/lists/oss-security/2015/05/18/10
http://seclists.org/fulldisclosure/2015/May/75
The MITRE CVE project is currently willing to follow that pattern for
some number of WordPress plugin disclosures. A possible advantage for
other people is receiving notification of security-relevant plugin
changelogs earlier. A possible disadvantage for other people is three
times as many public messages per disclosure. If this disadvantage is
very important, you can (among other options) send e-mail directly to
only cve-assign@...re.org to tell us. As far as we know, the list
guidelines at
http://oss-security.openwall.org/wiki/mailing-lists/oss-security would
imply that all of:
http://openwall.com/lists/oss-security/2015/05/18/8
http://openwall.com/lists/oss-security/2015/05/20/6
http://openwall.com/lists/oss-security/2015/05/22/2
are "Public security issues" that oss-security subscribers might want
to know about.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVXyPDAAoJEKllVAevmvmsu3AH/RSc8NVcuW77TXcpl3JiOygW
pTDrmSoF8bXfXpGA5OCDzwCZKXh4o3L/fgy/BaJYXaYi6s3d4M1I/k5nJaJ59p0R
XY1RC75Ow0Hbwi/6TkK0Tj+Ix4X8QMekdh+pfzPQ1AgZSQlgGvqDhkCzIViwVWtp
WrzSAV3mCWkA+RVBKbbhco1ruDfSGbtUY/MF+XgefQHKErB3+6H4vwEI0j27Il+I
noDqElpaztpz5CyqoUMnu+vQWQwHIj1MyBXNb9gLvTpm/YMXD5nab9SkJtVfp8/6
/YB3o4O22t643LFdHZJWNaWQA9pq2xCD+5u+J/8/F26/cMDrMOpcR9EGHXLLy44=
=S50W
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
