oss-sec mailing list archives
Re: possible CVE request: Tryton client input sanitization flaw
From: Kurt Seifried <kseifried () redhat com>
Date: Mon, 04 Nov 2013 13:18:38 -0700
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 11/04/2013 03:43 AM, Murray McAllister wrote:
Hello, An input sanitization flaw was found in the Tryton client: http://lists.debian.org/debian-security-announce/2013/msg00203.html
https://bugs.tryton.org/issue3446
http://hg.tryton.org/tryton/rev/357d0a4d9cb8 A malicious server could use this flaw to write to files accessible to the user running the Tryton client. There is some discussion in issue3446 about why a CVE may not be needed (starting at msg14493), and msg14507 notes a CVE could have possibly been assigned via OpenBSD ... so I defer to the CVE experts. Cheers, -- Murray McAllister / Red Hat Security Response Team
Please use CVE-2013-4510 for this issue. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) iQIcBAEBAgAGBQJSeAEeAAoJEBYNRVNeJnmTGG0QAIP55On+rsuPXfpErvUo4jms Ipku19ts/zeMWtFhtrj/5e54tZwtGowlAqTAUaraQC29537ImKwwWIbC3fjrr5nZ ynZ/h6EYUtpvbTITZhSQZYmq/Y9vWYPWH5qaga4R7A1rnZu6VdOcb2eR9YqB3ZPO SBVmlhryDT+/i+UY2Gyfb2odX6cUq/xHq7CF8g6TO9wtT2Ar48vNy4vXxK2oe0eB e/Qjib+ouLIRoBdGAH5Dw67jjjL3e1qQo7DDiVBGteJGcgn8jU5mvP2hLnU/v+F5 8WBWPfI6e9F4NAJxLJB0JMwdZklLkyIXYDd38yRE1ZaXp+hyxfuvt1bVaRFIVfqn om/sFLLjttlgPNoJSX6f1Hv9C7OmJx33holsGjnW1x/NmCh7ffBPqNCdVNvtqDxl 7m0fXdizZFxRms/YEdpirDTx8RZNzddiu8B7XSVvDyKK3Yydo3UoWZ/VvUb+PSKR q0mxrh5oiUEl3BJaOOFPmFUj/QqqdNQFnUamIztPPTHfO5YavIwKigBFtzvaKizB jQFfHu/OHzi0OgoJ335g9ZFhdFutr5Qqnby90b5gG40wP2kFiPuZ6/drIoLfMt27 CYPDNhe+MqTpQUUF6LJw7yFca+hZHN1obXdZ33Dzrl34m4HGxKIMVfVuidCqWfTi 3/qMQReJ+USpGIPfCTq4 =i5Rz -----END PGP SIGNATURE-----
Current thread:
- possible CVE request: Tryton client input sanitization flaw Murray McAllister (Nov 04)
- Re: possible CVE request: Tryton client input sanitization flaw Kurt Seifried (Nov 04)