[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201401092346.s09NkJGn003693@linus.mitre.org>
Date: Thu, 9 Jan 2014 18:46:19 -0500 (EST)
From: cve-assign@...re.org
To: djorm@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: remote code execution via deserialization in XStream
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> http://blog.diniscruz.com/2013/12/xstream-remote-code-execution-exploit.html
Use CVE-2013-7285.
At least initially, the scope of this CVE is "XStream is an
'reflection-based XML-to-Object conversion'" in that file, and all of
the implications of unrestricted conversion, including "allows the
creation of server side objects based on reflection (which means that
you could have all sorts of business-logic sensitive objects being
created)" -- which is mentioned separately in that file.
If this does not make sense, and multiple CVEs are needed, please let
us know.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJSzzPZAAoJEKllVAevmvms3cEH/3MBAH57R/LhQfI5ZMUm9FOD
eZm7p9IGl3PpSMtrwqSNwXS6InpfAmc04P0xX/HM4yFSRX6yHVaTZA9vbNGRs6PV
VdZg/A+WiUwdBdGhsFfXCb82QvCthdxyv6AAK5uNpVqQTqmikVPNk8gYxcHXZz3+
xUmUGLxwlCtImSZ1WiZMSCMYul3jsFsuOiVlqHF2NBoXh+55xmy8hLTOCUijILeG
lAXfMo25S971OJalr5pzGUC2EPUclV5D08+jv3KCNqryNphsepa3+14OKrvvz1yX
Q19c3+suDKWOUDvur9ENeHkf//Va881GNGZkcvppfvIkYCMI3vKFaWGMYRWR+jE=
=Jkgd
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
