oss-sec mailing list archives
Re: CVE request for Ushahidi
From: Tim <tim-security () sentinelchicken org>
Date: Thu, 9 Aug 2012 08:00:44 -0700
Hi Kurt, Do we have CVEs for these yet? Not sure if I missed the reply. Thanks, tim On Thu, Aug 02, 2012 at 04:50:17PM +1200, Robbie Mackay wrote:
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi Kurt, I've added info on which researcher discovered the vulnerability in each commit. Anything other info needed? Thanks, Robbie Mackay Software Developer, External Projects, Ushahidi Inc * Multiple SQL injections (Reported by Timothy D. Morgan, Kees Cook, postmodern ) https://github.com/ushahidi/Ushahidi_Web/commit/fdb48d1 (identified by Ushahidi dev team) https://github.com/ushahidi/Ushahidi_Web/commit/6f6a919 (postmodern) https://github.com/ushahidi/Ushahidi_Web/commit/4764792 (identified by Ushahidi dev team) https://github.com/ushahidi/Ushahidi_Web/commit/d954093 (identified by Ushahidi dev team) https://github.com/ushahidi/Ushahidi_Web/commit/3301e48 (Kees Cook) https://github.com/ushahidi/Ushahidi_Web/commit/68d9916 (postmodern) https://github.com/ushahidi/Ushahidi_Web/commit/e0e2b66 (postmodern) https://github.com/ushahidi/Ushahidi_Web/commit/a11d43c (postmodern) https://github.com/ushahidi/Ushahidi_Web/commit/3f14fa0 (Timothy D. Morgan) * Missing authentication on comments, reports, email API calls (Reported by Kees Cook, Dennison Williams) https://github.com/ushahidi/Ushahidi_Web/commit/4c24325 (Dennison Williams) https://github.com/ushahidi/Ushahidi_Web/commit/f67f4ad (Kees Cook) https://github.com/ushahidi/Ushahidi_Web/commit/13ca6f4 (Kees Cook) * User details exposed in comments API (Discovered by internal dev team) https://github.com/ushahidi/Ushahidi_Web/commit/529f353 * Admin user hijacking through the installer (Reported by Wil Clouser) https://github.com/ushahidi/Ushahidi_Web/commit/7892559 https://github.com/ushahidi/Ushahidi_Web/commit/fcdad03 * Stored XSS on member profile pages (Reported by Amy K. Farrell) https://github.com/ushahidi/Ushahidi_Web/commit/00eae4f On 1/08/12 6:07 AM, Kurt Seifried wrote:On 07/30/2012 06:22 PM, Robbie MacKay wrote:The Ushahidi team have been notified of the following security vulnerabilities thanks to volunteers from OWASP Portland. These will be fixed in the upcoming 2.5 release. Could you please allocate CVEs for the following issues?* Multiple SQL injections (Reported by Timothy D. Morgan, Kees Cook, postmodern ) https://github.com/ushahidi/Ushahidi_Web/commit/fdb48d1 https://github.com/ushahidi/Ushahidi_Web/commit/6f6a919 https://github.com/ushahidi/Ushahidi_Web/commit/4764792 https://github.com/ushahidi/Ushahidi_Web/commit/d954093 https://github.com/ushahidi/Ushahidi_Web/commit/3301e48 https://github.com/ushahidi/Ushahidi_Web/commit/68d9916 https://github.com/ushahidi/Ushahidi_Web/commit/e0e2b66 https://github.com/ushahidi/Ushahidi_Web/commit/a11d43c https://github.com/ushahidi/Ushahidi_Web/commit/3f14fa0* Missing authentication on comments, reports, email API calls (Reported by Kees Cook, Dennison Williams) https://github.com/ushahidi/Ushahidi_Web/commit/4c24325 https://github.com/ushahidi/Ushahidi_Web/commit/f67f4ad* User details exposed in comments API (Discovered by internal dev team) https://github.com/ushahidi/Ushahidi_Web/commit/529f353* Admin user hijacking through the installer (Reported by Wil Clouser) https://github.com/ushahidi/Ushahidi_Web/commit/7892559 https://github.com/ushahidi/Ushahidi_Web/commit/fcdad03* Stored XSS on member profile pages (Reported by Amy K. Farrell) https://github.com/ushahidi/Ushahidi_Web/commit/00eae4fThanks in advance,Robbie MackayYou'll need to list which commits were found by which security reporter (e.g. which ones are Reported by Timothy D. Morgan, Kees Cook, postmodern). Thanks.Software Developer, External Projects Ushahidi Inc e: robbie () ushahidi com skype: robbie.mackay-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (Darwin) Comment: GPGTools - http://gpgtools.org Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBAgAGBQJQGgcJAAoJEKnxsxigzOTXl7oH/1u8LLLxzy7SAKNxmVLPTwCK TKA8dal726TeIqyforOdXFABKkie+PjdeIBQM9FBHhgnAAQNhNa+K/DR9xg59JTd BjpAO/J4yyteyJdxh8+Xi31xbsWUyPdHDa79nLQ0PsetmXRd8EJ4xaL/EWK5N6hL OGnrQqujy4jTpwulf43D+gO7Rd6iZS4i+ghCUPpQ5IUeSvIMW5dYFrhgOLKjT5b/ okfdxBASbTZhc7nNZc0giQ4rGUrdcSOxQF7O0A2w2zELV/hBTRBN8mtBuY7DSgVO bLUjsHjKcFCbK90VoKdjxhTW7+KtLTUtdhanN4QzM7uRAqa8V1DTaBssn3Nu2YU= =tBbs -----END PGP SIGNATURE-----
Current thread:
- CVE request for Ushahidi Robbie MacKay (Jul 31)
- Re: CVE request for Ushahidi Kurt Seifried (Jul 31)
- Re: CVE request for Ushahidi Robbie Mackay (Aug 01)
- Re: CVE request for Ushahidi Tim (Aug 09)
- Re: CVE request for Ushahidi Kurt Seifried (Aug 09)
- Re: CVE request for Ushahidi Robbie Mackay (Aug 01)
- Re: CVE request for Ushahidi Kurt Seifried (Jul 31)