mailing list archives
Re: Re: CVE Status Clarification / Request -- kadu: Stored XSS by parsing contact's status and sms messages in history
From: cve-assign () mitre org
Date: Tue, 28 Feb 2012 14:18:14 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE-----
Argh sorry cut and paste the wrong CVE # into novell's bugzilla. Can
we just remove it from there please?
Removing Comment 4 from
https://bugzilla.novell.com/show_bug.cgi?id=749036 is definitely a
good idea, but MITRE will also do a REJECT of the CVE-2006-7248
identifier to address the issue more completely.
We often see vendors of CVE compatible products and services picking
up new CVE mappings from oss-security postings, and from references
cited in oss-security postings, and this often happens on the day of
the posting. Some vendors primarily just want the mapping, and aren't
really investigating the issues or possible discrepancies. So, here,
it's plausible that:
1. Vendor already discovered the web page for "Bug 749036 - VUL-0:
kadu: allows to inject js code."
2. Vendor quickly skimmed the text of 749036 and saw "use
CVE-2006-7248 for this issue." Vendor did not bother to go to the
openssl-dev link, or even consider that openssl-dev is not a
common forum for discussing Kadu.
3. Vendor immediately jumped to the conclusion that CVE-2006-7248 is
assigned to the Kadu issue, and updated a data set that
ultimately gets pushed out to their customers.
4. Sometime in the future, their customer decides to look up
CVE-2006-7248 on the MITRE CVE web site.
4a. If CVE-2006-7248 is a regular CVE entry about an OpenSSL
vulnerability, the customer might reach any of a variety of
incorrect conclusions, especially because Kadu apparently uses
OpenSSL through the QCA OSSL plugin for libqca2. The customer
might, for example, infer that CVE-2006-7248 is an unpatched
vulnerability affecting the Kadu EncryptionNgPlugin component.
4b. If CVE-2006-7248 is a rejected CVE entry that points to the
correct CVE identifiers for the Kadu issue and the OpenSSL
issue, then there's probably more hope that the customer will
find the correct information.
CVE assignment team, MITRE CVE Numbering Authority
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/obtain_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (SunOS)
-----END PGP SIGNATURE-----
Re: CVE Status Clarification / Request -- kadu: Stored XSS by parsing contact's status and sms messages in history Rafał Malinowski (Feb 27)