Groups > linux.debian.bugs.dist > #926512

Bug#905332: debdiff

From	wagner.ferenc@kifu.gov.hu (Ferenc Wágner)
Newsgroups	linux.debian.bugs.dist
Subject	Bug#905332: debdiff
Date	2018-11-06 10:40 +0100
Message-ID	<wR602-8jZ-9@gated-at.bofh.it> (permalink)
References	(4 earlier) <wiHGN-3Y8-9@gated-at.bofh.it> <wiHGN-3Y8-9@gated-at.bofh.it> <wR4AW-7CQ-17@gated-at.bofh.it> <wiDDb-1AH-3@gated-at.bofh.it> <wR4AW-7CQ-17@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

Christian Fischer <christian.fischer@greenbone.net> writes:

> On Fri, 03 Aug 2018 14:42:16 +0200 wferi@niif.hu (Ferenc Wágner) wrote:
>
>> Unfortunately the CVE hasn't arrived yet; I'll
>> forward it to you once it does.  My acknowledgement mail is of
>> subject "CVE Request 548000 for CVE ID Request" from
>> CVE-Request@mitre.org (just for the record).
>
> have you received a CVE for this issue yet? Tried to look around in
> various sources but wasn't able to identify a published CVE for this
> issue yet.

Hi,

I haven't received a CVE for this issue, unfortunately.  My original
request was deflected by Mitre saying that the Apache Software
Foundation should issue this CVE.  However, the Apache webpage states
that they issue IDs for undisclosed vulnerabilities only.  My three
followup mails asking for clarification remained unanswered by Mitre.

To add more bad news, according to http://santuario.apache.org/ the just
released 2.0.2 fixes a very similar bug, which might mean another DoS; I
couldn't investigate yet.  But if it does, we'll need yet another CVE
for that.  I'm sending out some queries.
-- 
Regards,
Feri

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#905332: debdiff Christian Fischer <christian.fischer@greenbone.net> - 2018-11-06 09:10 +0100
  Bug#905332: debdiff wagner.ferenc@kifu.gov.hu (Ferenc Wágner) - 2018-11-06 10:40 +0100

csiph-web