oss-sec mailing list archives
Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection
From: Kurt Seifried <kseifried () redhat com>
Date: Wed, 14 Sep 2016 17:08:31 -0600
On Wed, Sep 14, 2016 at 4:37 PM, Seth Arnold <seth.arnold () canonical com> wrote:
On Wed, Sep 14, 2016 at 10:22:58AM -0600, Kurt Seifried wrote:Ideally people should get CVEs and then post to oss-security with the information and the CVE. A lot of people consume the list data and the current method means that people end up searching their DBs, making sure it's new, then entering it, then updating it with a CVE. If people gotCVEsfirst this would vastly simplify things.I don't like the idea of waiting on CVE assignment before posting information here: - MITRE's team does impressive work, but some assignments take significantly longer than others; a request here, publicly, allows users to mitigate or fix before a number is known.
So join the DWF and help us get the OpenSource CVEs out quicker.
- In cases when there are no fixes yet, or incomplete fixes, it may not be known how many CVEs are even needed -- making the issues widely known earlier increases the chances of someone preparing patches, to clarify how many issues existed.
Also solved in DWF land ( https://github.com/distributedweaknessfiling/DWF-Database), I explicitly setup the DWF up to handle this, the database explicitly supports a "REPLACED_BY" state for a CVE: REPLACED_BY A list of one or more CVE's that have replaced this entry and what the relationship is (e.g. a CVE split may break a single existing CVE into multiple CVEs). The format is RELATION:CVE, if there are multiple entries they are comma separated (the entire field is quoted). Valid relationships are currently: DUPLICATE_OF SPLIT_TO SPLIT_FROM MERGED_TO MERGED_FROM REJECT This field is only used if the CVE is split/merged/found to be a duplicate or rejected. So if we need to clean things up later, we can easily.
- With MITRE's reduced scope of CVE coverage, there's the risk that software that's important to list members or the wider computing public may not get a number at all. Not getting a number assigned may give the impression that the issue isn't important.
This is the Open Source Security List. The DWF mandate is all Open Source. So once the DWF is up and running the Venn diagram of oss-security and DWF is basically a single circle =).
Thanks
-- -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Red Hat Product Security contact: secalert () redhat com
Current thread:
- ADOdb PDO driver: incorrect quoting may allow SQL injection Damien Regad (Sep 07)
- Re: ADOdb PDO driver: incorrect quoting may allow SQL injection Damien Regad (Sep 13)
- Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection Andreas Stieger (Sep 14)
- Message not available
- Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection Anonymous (Sep 14)
- Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection Moritz Muehlenhoff (Sep 14)
- Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection Kurt Seifried (Sep 14)
- Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection Jeremy Stanley (Sep 14)
- Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection Seth Arnold (Sep 14)
- Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection Kurt Seifried (Sep 14)
- Re: ADOdb PDO driver: incorrect quoting may allow SQL injection Damien Regad (Sep 13)
- Re: ADOdb PDO driver: incorrect quoting may allow SQL injection Damien Regad (Sep 15)