[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120513081938.GB30921@kludge.henri.nerv.fi>
Date: Sun, 13 May 2012 11:19:38 +0300
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Cc: Matthieu Aubry <matthieu.aubry@...il.com>
Subject: Re: CVE request: Piwik before 1.7
On Tue, May 08, 2012 at 10:44:46PM -0600, Kurt Seifried wrote:
> On 05/08/2012 03:03 AM, Hanno Böck wrote:
> > Hi,
> >
> > http://piwik.org/blog/2012/02/7775/
> >
> > Information is very rare: "We would like to thank the following
> > security researchers for their responsible disclosure of XSS &
> > click-jacking issues: Piotr Duszynski, Sergey Markov, Mauro
> > Gentile."
> >
> > I'd suggest assigning 3 CVEs with subjects like
> >
> > "Unknown XSS or clickjacking issue identified by Piotr Duszynski"
> > "Unknown XSS or clickjacking issue identified by Sergey Markov"
> > "Unknown XSS or clickjacking issue identified by Mauro Gentile"
>
>
> We would like to thank the following security researchers for their
> responsible disclosure of XSS & click-jacking issues: Piotr Duszynski,
> Sergey Markov, Mauro Gentile.
> Thank you for disclosing security issues to the Piwik team, ensuring a
> healthy and safe experience for the whole community!
>
> I can't find anything else. Can you send the code commits that address
> this?
>
>
> - --
> Kurt Seifried Red Hat Security Response Team (SRT)
I requested more details from security@ and got following reply from Matthieu Aubry:
"""
Hi Henri,
I agree it sounds like a good idea to describe exactly what went
wrong, in a spirit of openness and learning from mistakes.
however, Piwik data is very sensitive. Many Piwik users don't upgrade
and use older vulnerable version, sometimes data leaking are
possible. If we give the details, first of all it takes time and
energy which is already 100% booked, and secondly it would help black
hat write bots to scrape and do bad.
This is not a good investment of our time sorry...
but I appreciate your work :)
Matt
"""
I do not think this is good way to improve security. In my opinion these issues still need CVE-identifiers, but details will limit to "unknown XSS" etc. Does these get three or one CVE-identifier?
- Henri Salo
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
