Re: possible CVE request: Tryton client input sanitization flaw

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 11/04/2013 03:43 AM, Murray McAllister wrote:
> Hello,
>
> An input sanitization flaw was found in the Tryton client:
>
> http://lists.debian.org/debian-security-announce/2013/msg00203.html
https://bugs.tryton.org/issue3446
> http://hg.tryton.org/tryton/rev/357d0a4d9cb8
>
> A malicious server could use this flaw to write to files accessible
> to the user running the Tryton client.
>
> There is some discussion in issue3446 about why a CVE may not be
> needed (starting at msg14493), and msg14507 notes a CVE could have
> possibly been assigned via OpenBSD ... so I defer to the CVE
> experts.
>
> Cheers,
>
> -- Murray McAllister / Red Hat Security Response Team

Please use CVE-2013-4510 for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)

iQIcBAEBAgAGBQJSeAEeAAoJEBYNRVNeJnmTGG0QAIP55On+rsuPXfpErvUo4jms
Ipku19ts/zeMWtFhtrj/5e54tZwtGowlAqTAUaraQC29537ImKwwWIbC3fjrr5nZ
ynZ/h6EYUtpvbTITZhSQZYmq/Y9vWYPWH5qaga4R7A1rnZu6VdOcb2eR9YqB3ZPO
SBVmlhryDT+/i+UY2Gyfb2odX6cUq/xHq7CF8g6TO9wtT2Ar48vNy4vXxK2oe0eB
e/Qjib+ouLIRoBdGAH5Dw67jjjL3e1qQo7DDiVBGteJGcgn8jU5mvP2hLnU/v+F5
8WBWPfI6e9F4NAJxLJB0JMwdZklLkyIXYDd38yRE1ZaXp+hyxfuvt1bVaRFIVfqn
om/sFLLjttlgPNoJSX6f1Hv9C7OmJx33holsGjnW1x/NmCh7ffBPqNCdVNvtqDxl
7m0fXdizZFxRms/YEdpirDTx8RZNzddiu8B7XSVvDyKK3Yydo3UoWZ/VvUb+PSKR
q0mxrh5oiUEl3BJaOOFPmFUj/QqqdNQFnUamIztPPTHfO5YavIwKigBFtzvaKizB
jQFfHu/OHzi0OgoJ335g9ZFhdFutr5Qqnby90b5gG40wP2kFiPuZ6/drIoLfMt27
CYPDNhe+MqTpQUUF6LJw7yFca+hZHN1obXdZ33Dzrl34m4HGxKIMVfVuidCqWfTi
3/qMQReJ+USpGIPfCTq4
=i5Rz
-----END PGP SIGNATURE-----