[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20080727111916.GA19470@ngolde.de>
Date: Sun, 27 Jul 2008 13:19:16 +0200
From: Nico Golde <oss-security+ml@...lde.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: drupal issue in < 5.9
Hi,
* Steven M. Christey <coley@...us.mitre.org> [2008-07-27 11:41]:
> On Sat, 26 Jul 2008, Miklos Vajna wrote:
>
> > On Sat, Jul 26, 2008 at 09:27:33PM +0200, Nico Golde <oss-security+ml@...lde.de> wrote:
> > >
> > > This is CVE-2008-3222.
> >
> > Isn't this different?
> >
> > It refers to http://www.openwall.com/lists/oss-security/2008/07/10/3
> > which is a bug fixed in 5.8.
> >
> > The issue I'm talking about is _not_ fixed in 5.8.
>
> My interpretation of this new advisory is that they meant to fix the
> session fixation in 5.8, but they didn't. The original advisory covered
> multiple other issues as well. So this new advisory might better be
> considered a clarification of versions for the session fixation, rather
> than a regression error or incomplete fix (which would require a new CVE).
>
> Granted, the lack of specifics from Drupal makes it difficult to be
> certain about what happened.
Yes, I have no idea either but at least the patch stayed the
same.
Cheers
Nico
--
Nico Golde - http://www.ngolde.de - nion@...ber.ccc.de - GPG: 0x73647CFF
For security reasons, all text in this mail is double-rot13 encrypted.
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
