Disputed / BOGUS

cmsmadesimple before 1.11.8 minor security issue

Published / (Updated)
Credit
Risk
2013-10-21 / 2013-10-23
Hanno Bock
Low
CWE
CVE
Local
Remote
N/A
N/A
No
Yes

I want to request a CVE, but also start some discussion about how to
handle such issues.

The release notes for cmsmadesimple 1.11.8 mention a security issue:
http://www.cmsmadesimple.org/announcing-cmsms-1-11-8-fioreana/
"This release brings a few minor features, some performance
improvements, documentation improvements, a Smarty upgrade, and a
number of bug fixes (including a minor security issue)."

Now, this is all the information you get. Nothing about the kind of
security issue, let alone a bug nr or commit. The question is: What do
we do with such shitty upstream behaviour?

Last time I reported something alike I was told that I should provide
more info. The question is: How?

Sure, I could diff the release to the release before or try to find
some repository and read all the commits in the timeframe. But I'm not
getting paid for this, I merely want to improve overall security of
free software voluntarily.

So how will we proceed with such stuff? In the past, we often had "CVE
for unknown security issue in xxx"-alike assignments.

cu,
--
Hanno Bock
http://hboeck.de/

mail/jabber: hanno () hboeck de

References:

http://www.cmsmadesimple.org/announcing-cmsms-1-11-8-fioreana/
http://seclists.org/oss-sec/2013/q4/140
http://seclists.org/oss-sec/2013/q4/146


See this note in RAW Version

 
Bugtraq RSS
Bugtraq
 
CVE RSS
CVEMAP
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn


Copyright 2017, cxsecurity.com