WARNING! Fake news / Disputed / BOGUS

cmsmadesimple before 1.11.8 minor security issue

2013-10-21 / 2013-10-23
Credit: Hanno Bock
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

I want to request a CVE, but also start some discussion about how to handle such issues. The release notes for cmsmadesimple 1.11.8 mention a security issue: http://www.cmsmadesimple.org/announcing-cmsms-1-11-8-fioreana/ "This release brings a few minor features, some performance improvements, documentation improvements, a Smarty upgrade, and a number of bug fixes (including a minor security issue)." Now, this is all the information you get. Nothing about the kind of security issue, let alone a bug nr or commit. The question is: What do we do with such shitty upstream behaviour? Last time I reported something alike I was told that I should provide more info. The question is: How? Sure, I could diff the release to the release before or try to find some repository and read all the commits in the timeframe. But I'm not getting paid for this, I merely want to improve overall security of free software voluntarily. So how will we proceed with such stuff? In the past, we often had "CVE for unknown security issue in xxx"-alike assignments. cu, -- Hanno Bock http://hboeck.de/ mail/jabber: hanno () hboeck de

References:

http://www.cmsmadesimple.org/announcing-cmsms-1-11-8-fioreana/
http://seclists.org/oss-sec/2013/q4/140
http://seclists.org/oss-sec/2013/q4/146


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top