[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <33901844.19080402.1354758657191.JavaMail.root@redhat.com>
Date: Wed, 5 Dec 2012 20:50:57 -0500 (EST)
From: Josh Bressers <bressers@...hat.com>
To: Vincent Danen <vdanen@...hat.com>
Cc: coley <coley@...re.org>, security-2012@...irrelmail.org,
oss-security@...ts.openwall.com
Subject: Re: Strange CVE situation (at least one ID should
come of this)
----- Original Message -----
> * [2012-12-03 22:26:29 -0700] Kurt Seifried wrote:
>
> >-----BEGIN PGP SIGNED MESSAGE-----
> >Hash: SHA1
> >
> >On 10/26/2012 01:54 PM, Josh Bressers wrote:
> >> Hello,
> >>
> >> This Squirrelmail plugin came to my attention a few weeks back:
> >> http://squirrelmail.org/plugin_view.php?id=117
> >>
> >> It's from 2004, which is suspect in itself, but I took a look
> >> after
> >> someone asked. It's pretty scary in there.
> >>
> >> If I was to list the security problems I found after a few minutes
> >> of looking, they are:
> >>
> >> * It uses MD5 passwords
> >
> >Going with this one since there's a good number of MD5 related CVE's
> >already.
> >
> >Please use CVE-2012-5623 for this issue.
>
> Shouldn't this be a 2004 CVE, since it was fixed in 2004?
>
No, it's not fixed at all. The module would need a rather invasive rewrite
to "fix" this. I really just wanted a CVE ID as a warning of "don't use
this". 2004 is the last time it was updated :)
Thanks.
--
JB
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
