Re: CVE request: XSS is Google Web Toolkit (GWT)

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 10/29/2012 07:26 PM, David Jorm wrote:
> I note that with the release of google web toolkit (GWT) 2.5, a
> security flaw has been resolved. The best details I can find are
> at:
>
> https://developers.google.com/web-toolkit/release-notes#Release_Notes_2_4_0
> (scroll to "Security vulnerability in GWT 2.4")
>
> The release notes state:
>
> "Recently, the GWT team discovered a cross-site scripting
> vulnerability in the 2.4 Beta and Release Candidate releases (not
> in v2.3 GA or v2.4 GA). This vulnerability was partially fixed in
> the 2.4 GA release and completely fixed in the 2.5 GA release. If
> you have an app that's been built with 2.4 then you'll need to get
> the latest 2.5 release, recompile your app, and redeploy."
>
> I can't find any details on the flaw, a CVE ID, a public bug or a
> commit. I have contacted security@google asking for these details,
> but no response yet. Can we assign a CVE ID to this flaw in the
> absence of these details?
>
> Thanks

Just confirming with the Google security team they haven't assigned a
CVE for this issue (I can't find anything at all, and Google is still
a CVE Naming Authority correct?). Any ways unless I hear otherwise
I'll assign a CVE for this tomorrow.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iQIcBAEBAgAGBQJQjzL/AAoJEBYNRVNeJnmTfvIP/A/663U4FWWEuMpz8GKyQ+Y6
8iebsrNtu+2HehBmwmpi8fY4c8q+G6brxzOt786fGTY+3MufmHLdbyD9xthpxTtV
t1fAjuevjk4mL+bouJheXdGIaCD5uJLfW+6WSUFoHK/iUmaafpXi5BMJEjTg9Vze
Ye4XPoeCCFHkSbrucwDPgJBbziqXqUCZ2jHm90ay0qrrSP5Om3wkm8EFx26LkNik
QvGiv3fyc3sHSUg/yucwufnUGVK+BIONfJjOipj/aeiXh0jyA7sst041t8aG88en
ODwgRVsVKyVQ/afh3CMbefSSd2dLR6meSeE/7+uQKepAiG7j7FrgPjdR0mxX/xh+
a6Dk69KMlJqqbjb2hJ+zCUos/uJRQYQVQkVYuxW745BIdnifoBc7DRj8vzhADooO
GsrGKW0nLFIFqHGqXXx8W/M5ZX7YnU6rz9XmKyH8eA12iBqw4zQdOa2qAjR0ADRA
m8NzB8CHwjcC3OBi+YLjpgy40JGhrAvTS5wSFVySkAMs+w657xf6bNf7WfLeJada
ATvA6UTy/1Ye88OdOD5At500eG3JrTRiZVm23dHPXtjQPScUgnGL5s85tsd5O23d
pTbKwsETH8PUGlcaFrTP363mG+89+d9BssbnkT4OKFnbIaGC44a69oXQJEPkyxey
FVHKtRr4QdaVIP3vBk85
=VofW
-----END PGP SIGNATURE-----