Re: CVE request: irssi 0.8.15

[Josh Bressers <bressers () redhat com>]

----- "Steven M. Christey" <coley () linus mitre org> wrote:

> On Mon, 12 Apr 2010, Josh Bressers wrote:
>
> > > "This release fixes two security issues: The first being that Irssi
> > > didn't check hostname on SSL connections and the other being a hard to
> > > exploit remote crash bug."
>
> > The crash bits mentioned in the changelog are very ambiguous. The git
> > tree isn't any more clear than that. There appear to be two crashes,
> > both sound like NULL pointer dereferences that cannot be triggered by
> > an attacker. If I'm wrong, please speak up.
>
> Josh, I think we should assign another CVE anyway.  The upstream vendor
> has explicitly labeled this as a security issue, so even if it seems of
> limited severity, that's enough to trigger creation of a CVE.  The use of
> the "remote crash" term also reinforces the need for a CVE.
>
> This might be juse a plain old crasher from the perspective of many
> downstream vendors, but it's still worthy of inclusion in CVE because
> there is a significant population that would treat it as a "security"
> problem even if it's low severity.
>
> Should I assign one or should you?

Your reasoning makes sense, I'm happy to assign an ID. Thanks.

CVE-2010-1156 irssi 0.8.15 remote DoS

-- 
    JB