[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20121129110620.7ccb545c.fk@fabiankeil.de>
Date: Thu, 29 Nov 2012 11:06:20 +0100
From: Fabian Keil <fk@...iankeil.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: Curl insecure usage
Kurt Seifried <kseifried@...hat.com> wrote:
> On 11/26/2012 11:42 AM, Kurt Seifried wrote:
> > On 11/26/2012 08:06 AM, Moritz Muehlenhoff wrote:
> >> Hi, during the triage of the SSL client bugs spotted by the
> >> http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf paper Debian
> >> developer Alessandro Ghedini discovered two more applications
> >> using Curl in an insecure manner:
> >
> >> 1. opendnssec (in the eppclient tool)
> >> http://lists.opendnssec.org/pipermail/opendnssec-user/2012-November/002296.html
>
> Please
> >>
> use CVE-2012-5582 for opendnssec: insecure usage of curl
>
> >> 2. PHPcas (used by Moodle e.g.):
> >> https://github.com/Jasig/phpCAS/pull/58
>
> Please use CVE-2012-5583 for phpCAS: insecure usage of curl
> > Have these been receiving individual CVE's? I can't find any
> > offhand, can you provide examples of others?
>
> Also can someone collate and post a list of all the other apps using
> curl insecurely and need CVE's with appropriate links to the
> upstreams/etc? Thanks.
Note that curl is the (unaffected) command line tool based on libcurl.
The CVEs should probably refer to insecure usage of libcurl to prevent
confusion.
Fabian
Download attachment "signature.asc" of type "application/pgp-signature" (197 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
