Re: CVE request: lxr

["Steven M. Christey" <coley () linus mitre org>]

On Mon, 3 May 2010, Henri Salo wrote:

> On Mon, 3 May 2010 09:31:16 -0400
> Dan Rosenberg <dan.j.rosenberg () gmail com> wrote:
>
> Several XSS-vulnerabilities can have one CVE at least when those
> vulnerabilities are fixed at the same time.

Another factor is when they are published at the same time.

> Can someone verify what is the policy by the book?

It's never as easy as just a couple rules, unfortunately.  In this case, 
CVE-2009-4497 has been around for a long time, so it's strongly attached 
to *only* the "i" parameter/ident issue.  It's too risky to change the 
fundamental meaning of a CVE after it's been published.  (So even though 
the intention of Dan's original request may have been to cover other 
issues, that's not what it looks like to the public any more.)

Josh assigned CVE-2010-1448 for the search page issue, and now Dan has 
alluded to a third issue that is neither ident nor search page, but we 
don't know what that third issue is.

If Dan's issue is what he calls "a third XSS bug" in 
http://www.openwall.com/lists/oss-security/2010/05/03/7 then I'd want a 
different CVE for it - since it's addressed in a separate "version" than 
the other two XSS bugs.

The crux of the problem here is that the original bug report alluded to 
"several" XSS but only listed the ident issue; our CVE description 
typically might say "multiple XSS, for example this particular vector," 
but we didn't do that... and neither does the vendor specifically indicate 
that the other vaguely-specified issues were actually addressed.

- Steve