Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20111201141428.GP21767@foo.fgeek.fi>
Date: Thu, 1 Dec 2011 16:14:28 +0200
From: Henri Salo <henri@...v.fi>
To: Secunia Research <vuln@...unia.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE-request: Serendipity
 'serendipity[filter][bp.ALT]' Cross-Site Scripting vulnerability

On Thu, Dec 01, 2011 at 02:13:16PM +0100, Secunia Research wrote:
> Henri,
> 
> The GIT commit referenced by the Secunia advisory [1] is the correct fix for
> this issue.
> 
> The fix removed a line in the code that displayed an unsanitised variable in
> one of the template files. This variable was inside a JavaScript comment
> block, but this does not prevent exploitation when the payload is prefixed
> with a </script> tag.
> 
> [1]
> https://github.com/s9y/Serendipity/commit/1f037b462761cd592b90541ce4dfda2518
> ad4711
> 
> --
> 
> Med venlig hilsen / Kind Regards,
>  
> Jon Butler
> Junior Security Specialist
>   
> Secunia
> Mikado House
> Rued Langgaardsvej 8
> 2300 Copenhagen S
> Denmark 
> 
> Phone +45 3338 5726
> 
> Please visit our corporate website:
> www.secunia.com
>    
> Follow us on Twitter:
> http://twitter.com/secunia

Sorry I misunderstood. Thank you for clearing this out. Developer of this software did not comment anything when I asked if this is correct or not, but they indeed told me about a change to different version controlling software.

- Henri Salo

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.