[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201402121621.s1CGLIwL013645@linus.mitre.org>
Date: Wed, 12 Feb 2014 11:21:18 -0500 (EST)
From: cve-assign@...re.org
To: hanno@...eck.de
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request: python-gnupg before 0.3.5 shell injection
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> Second, 0.3.5 and 0.3.6 have a series of differences in handling of
> command-line arguments. This seems to be most likely a reaction to
> Florian Weimer's observation of "you need to make sure that you
> prevent option injection through positional arguments." Does anyone
> believe that option injection was impossible in 0.3.5? If not, we will
> make a fourth CVE assignment.
Use CVE-2014-1929.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJS+57hAAoJEKllVAevmvmshgoH/i9CI0xncK8FfQE2t8dA96Cc
3u94LLYzD+hqLMKSuNdArk7ekx00M/53p6ntFqff+neZWGLqVteo4ZPUFspWIv0W
P7u1GWAMZl75KamqgRXrcp5mPbE5axe7FrEW0Z3Wd0PdT4xWMa9GUALypqGrOYNr
zHehk+eLhqqapD4Z2xBFDjMEAzHobTeOHXP7tOL7e7+ut3UMmGAlG/i6FIBn3XKq
/X2mHQ8EykDyb09oyih20NuttOtNr9aOkTJyODJK6Yqdr7gPu3tD3TVogqYvYNRm
qwPZZLfEqvH4rlMsua/exySvQSMp+eOl+NJ720YRU8XPRzZGzxqZguaayAryT+U=
=Pt+A
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
