Re: [security] Pending CVE assignments for SA-CORE-2014-006?

[Peter Wolanin <pwolanin () gmail com>]

re: https://www.drupal.org/node/2378367

The phpass module for Drupal 6 contains the backport from Drupal 7 of
the code related to the DoS, CVE-2014-9016

Since it's identical code, should I use the same CVE number, or since
it's a contributed project, there will be a distinct one issued?

Thanks,

Peter Wolanin

On Thu, Nov 20, 2014 at 9:48 AM,  <cve-assign () mitre org> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> > Session hijacking (Drupal 6 and 7)
>
> Use CVE-2014-9015.
>
>
> > Denial of service (Drupal 7 only)
>
> Use CVE-2014-9016.
>
> - --
> CVE assignment team, MITRE CVE Numbering Authority
> M/S M300
> 202 Burlington Road, Bedford, MA 01730 USA
> [ PGP key available through http://cve.mitre.org/cve/request_id.html ]
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.14 (SunOS)
>
> iQEcBAEBAgAGBQJUbf58AAoJEKllVAevmvms2qcIAItiBrXYCr3qbvFieEgqWdZT
> UX/Z+6TcS65VB2JrLKXDgMLArWIXRQWVT/1dORotEabeEhtgGbaBljyH4KsHDp8W
> cwxcbmB6hgUpbWax4Kgo5a0JMBshWYUKU8cxQVmLWuVjBzhgcveNfcBYKd66hLP4
> iLroECbXKmn27/LCrlumwskxIOmjBLkecCH4cu3UXZdK46GpuxMxbSWlSSdBC0XF
> E3Svx0GxpwZIRDAA8bUXgwnMUgJkeiER+vbmD7l0Ool2/961SIhHWDfbfFClW4Xv
> lFW0qqRJtT6JXcoi9NSZiMRRDawVwXHqmUqTA9Es3OBULJEzh6N2gehNt8fSPqg=
> =olvS
> -----END PGP SIGNATURE-----
> --
> [ Security | https://lists.drupal.org/mailman/listinfo/security ]
> [Security team mailing list management and scheduling is documented here | 
> https://security.drupal.org/handling-list-emails]