Package: elog
Severity: grave
Tags: security
Justification: user security hole
In #389361 a complete lack of web script sanitising for logbook entries
was discovered and DSA-967 already fixed lots of vulnerabilities.
AFAICT Debian is the only distribution including elog, which seems
to have received relatively few external review. I guess it should
only be included in Etch after an audit by the debian-audit people.
Audit people, do you think you can review it before Etch?
Cheers,
Moritz
-- System Information:
Debian Release: testing/unstable
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-1-686
Locale: LANG=C, [EMAIL PROTECTED] (charmap=ISO-8859-15)
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
