[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <501A0709.2050808@ushahidi.com>
Date: Thu, 02 Aug 2012 16:50:17 +1200
From: Robbie Mackay <robbie@...ahidi.com>
To: Kurt Seifried <kseifried@...hat.com>
CC: oss-security@...ts.openwall.com, Heather Leson <HLeson@...ahidi.com>
Subject: Re: CVE request for Ushahidi
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Hi Kurt,
I've added info on which researcher discovered the vulnerability in
each commit. Anything other info needed?
Thanks,
Robbie Mackay
Software Developer, External Projects, Ushahidi Inc
* Multiple SQL injections (Reported by Timothy D. Morgan, Kees Cook,
postmodern )
https://github.com/ushahidi/Ushahidi_Web/commit/fdb48d1 (identified by
Ushahidi dev team)
https://github.com/ushahidi/Ushahidi_Web/commit/6f6a919 (postmodern)
https://github.com/ushahidi/Ushahidi_Web/commit/4764792 (identified by
Ushahidi dev team)
https://github.com/ushahidi/Ushahidi_Web/commit/d954093 (identified by
Ushahidi dev team)
https://github.com/ushahidi/Ushahidi_Web/commit/3301e48 (Kees Cook)
https://github.com/ushahidi/Ushahidi_Web/commit/68d9916 (postmodern)
https://github.com/ushahidi/Ushahidi_Web/commit/e0e2b66 (postmodern)
https://github.com/ushahidi/Ushahidi_Web/commit/a11d43c (postmodern)
https://github.com/ushahidi/Ushahidi_Web/commit/3f14fa0 (Timothy D.
Morgan)
* Missing authentication on comments, reports, email API calls
(Reported by Kees Cook, Dennison Williams)
https://github.com/ushahidi/Ushahidi_Web/commit/4c24325 (Dennison
Williams)
https://github.com/ushahidi/Ushahidi_Web/commit/f67f4ad (Kees Cook)
https://github.com/ushahidi/Ushahidi_Web/commit/13ca6f4 (Kees Cook)
* User details exposed in comments API (Discovered by internal dev team)
https://github.com/ushahidi/Ushahidi_Web/commit/529f353
* Admin user hijacking through the installer (Reported by Wil Clouser)
https://github.com/ushahidi/Ushahidi_Web/commit/7892559
https://github.com/ushahidi/Ushahidi_Web/commit/fcdad03
* Stored XSS on member profile pages (Reported by Amy K. Farrell)
https://github.com/ushahidi/Ushahidi_Web/commit/00eae4f
On 1/08/12 6:07 AM, Kurt Seifried wrote:
> On 07/30/2012 06:22 PM, Robbie MacKay wrote:
>> The Ushahidi team have been notified of the following security
>> vulnerabilities thanks to volunteers from OWASP Portland. These
>> will be fixed in the upcoming 2.5 release. Could you please
>> allocate CVEs for the following issues?
>
>> * Multiple SQL injections (Reported by Timothy D. Morgan, Kees
>> Cook, postmodern )
>> https://github.com/ushahidi/Ushahidi_Web/commit/fdb48d1
>> https://github.com/ushahidi/Ushahidi_Web/commit/6f6a919
>> https://github.com/ushahidi/Ushahidi_Web/commit/4764792
>> https://github.com/ushahidi/Ushahidi_Web/commit/d954093
>> https://github.com/ushahidi/Ushahidi_Web/commit/3301e48
>> https://github.com/ushahidi/Ushahidi_Web/commit/68d9916
>> https://github.com/ushahidi/Ushahidi_Web/commit/e0e2b66
>> https://github.com/ushahidi/Ushahidi_Web/commit/a11d43c
>> https://github.com/ushahidi/Ushahidi_Web/commit/3f14fa0
>
>> * Missing authentication on comments, reports, email API calls
>> (Reported by Kees Cook, Dennison Williams)
>> https://github.com/ushahidi/Ushahidi_Web/commit/4c24325
>> https://github.com/ushahidi/Ushahidi_Web/commit/f67f4ad
>
>> * User details exposed in comments API (Discovered by internal
>> dev team)
>> https://github.com/ushahidi/Ushahidi_Web/commit/529f353
>
>> * Admin user hijacking through the installer (Reported by Wil
>> Clouser) https://github.com/ushahidi/Ushahidi_Web/commit/7892559
>> https://github.com/ushahidi/Ushahidi_Web/commit/fcdad03
>
>> * Stored XSS on member profile pages (Reported by Amy K. Farrell)
>> https://github.com/ushahidi/Ushahidi_Web/commit/00eae4f
>
>> Thanks in advance,
>
>> Robbie Mackay
>
> You'll need to list which commits were found by which security
> reporter (e.g. which ones are Reported by Timothy D. Morgan, Kees
> Cook, postmodern). Thanks.
>
>
>> Software Developer, External Projects Ushahidi Inc e:
>> robbie@...ahidi.com skype: robbie.mackay
>
>
>
>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQEcBAEBAgAGBQJQGgcJAAoJEKnxsxigzOTXl7oH/1u8LLLxzy7SAKNxmVLPTwCK
TKA8dal726TeIqyforOdXFABKkie+PjdeIBQM9FBHhgnAAQNhNa+K/DR9xg59JTd
BjpAO/J4yyteyJdxh8+Xi31xbsWUyPdHDa79nLQ0PsetmXRd8EJ4xaL/EWK5N6hL
OGnrQqujy4jTpwulf43D+gO7Rd6iZS4i+ghCUPpQ5IUeSvIMW5dYFrhgOLKjT5b/
okfdxBASbTZhc7nNZc0giQ4rGUrdcSOxQF7O0A2w2zELV/hBTRBN8mtBuY7DSgVO
bLUjsHjKcFCbK90VoKdjxhTW7+KtLTUtdhanN4QzM7uRAqa8V1DTaBssn3Nu2YU=
=tBbs
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
