Re: CVEs for wordpress 3.4.2 release

[Yves-Alexis Perez <corsac () debian org>]

On mer., 2012-09-12 at 13:38 +0300, Hanno Boeck wrote:
> I can't find CVEs assigend for the issues fixed in wordpress 3.4.2.
>
> http://wordpress.org/news/2012/09/wordpress-3-4-2/
>
>
> Sadly, the information is quite limited:
> "Version 3.4.2 also fixes a few security issues and contains some
> security hardening. The vulnerabilities included potential privilege
> escalation and a bug that affects multisite installs with untrusted
> users. These issues were discovered and fixed by the WordPress security
> team."
>
> I suggest assigning two:
> 1. potential privilege escalation
> 2. problem with untrusted users on multisite installations
> unless someone has more information.

It's alway pretty annoying to try to fix CVEs in wordpress releases,
since they are usually allocated just on some release announcement, and
thus identifying specific commits is pretty hard. It'd be nice if
Wordpress security team could be in the loop since the beginning, it
might help a bit later (so adding them to CC: now)

Regards,
-- 
Yves-Alexis

Attachment: signature.asc
Description: This is a digitally signed message part