Re: [Red Hat - Possible Forgery] Re: [oss-security] Ruby CVEs

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 03/20/2013 02:43 AM, Kurt Seifried wrote:

Argh I didn't pay attention to Larry's previous emails where he listed
the CVE's assigned:

http://www.openwall.com/lists/oss-security/2013/03/19/9

http://www.osvdb.org/show/osvdb/91232  fastreader CVE-2013-2615
http://www.osvdb.org/show/osvdb/91231  MiniMagic  CVE-2013-2616
http://www.osvdb.org/show/osvdb/91230  Curl       CVE-2013-2617

Please don't send requests to oss-sec if you already sent a request to
Mitre/anyone else. Also I don't seem to have these in my emails from
Mitre (to VIM list or anywhere else)?

> ===================
> > > These 4 are all the ";" URL parsing issues ny larry0 () me com 
> > > =================== http://direct.osvdb.org/show/osvdb/91450 
> > > command_wrap gem
>
> Please use CVE-2013-1875 for this issue.

Did this one get a CVE from Mitre?

> > > http://direct.osvdb.org/show/osvdb/91232 fastreader gem
>
> Please use CVE-2013-1876 for this issue.

Please reject, use CVE-2013-2615 instead

> > > http://direct.osvdb.org/show/osvdb/91231 MiniMagic gem
>
> Please use CVE-2013-1877 for this issue.

Please reject, use CVE-2013-2616 instead

> > > http://direct.osvdb.org/show/osvdb/91230 Curl gem
>
> Please use CVE-2013-1878 for this issue.

Please reject, use CVE-2013-2617 instead

> > Please note that in private email Larry said he will request
> > CVEs for these security vulnerabilities. Adding Larry as CC so he
> > can tell us if he already did that and if he didn't we can assign
> > those in this thread.
>
> As per Larry's previous emails, assigning here.
>
> > --- Henri Salo

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRSXueAAoJEBYNRVNeJnmTtEMQANNhQAKQ0UGj3uBSz8ny5nhl
9xAQdE1xyw8O+dRNVQPfKWJofJYVJOmmNF8qaT1ME5MqRMiLU/kwzRGkvhvWx7Oc
G2KdxhJI4jlw2zpQgKipD4tsLoJ/IzI7eog7BDlS/x6IEVAi8KFGeHD81mkE+pr6
UxpieuXEOo5DdVLshW1sSm3jTAqi5FUr0SoQ8sqWKav/s13/+yPdn+nzVYubzNtj
NHnIk3v/WPVT39gT+2PNM2UpgtfOjmYuxuHVk/vBH5ivp5t/ryUsWlsLBRi7I5rd
VBtfAa6z/ihsyijP4cQtPkITd4n9MHBzoka4h38JKVKHJQua3uiA989XVIDsSqBb
/6j0RPuaMHBdDuYbpjUyKS1y8tbQPpne+M+6kM+iH6D7rIpDzm2AWGxW0WIPBs5e
KRCVme6zL73r4d5kzTwPiGwXw93/MAfiX6HndePGD5VRW4OqOiLQgZBXmz3E7vQa
tZNphYwzqd5xP19eIQeul/MEKhyjqJY7GHbAW9CVJBG4Rm1QP4mtKWohENUtO2DT
zfSiREBnElLUyjxo5WakO7s1HtrQOPRfqF45DLlTMMPMRaAcx5b0sK4HCZjX2MLG
7pndRiynI+/LtrBt/aZ6DfDlZiPNYokfKBnmhwaa0txlvsUlOt8ukYuNb0Aj4ynx
220tPPDf3KpQepiLwJQ+
=90CE
-----END PGP SIGNATURE-----