Re: [oss-security] CVE request for subversion

2011-01-09 Thread Kurt Seifried
> Sounds great. > > Should the Subversion project plan to write and publish advisories for > these CVEs, or has the requester already done so? I'm not affiliated with subversion so it's up to them (I assume they won't since they didn't do so originally). > -Hyrum -- Kurt Seifried k...@seifried.

Re: [oss-security] CVE request for subversion

2011-01-08 Thread Hyrum K Wright
On Wed, Jan 5, 2011 at 10:09 AM, Josh Bressers wrote: > > OK, let's split the CVE id then. > > So for > A, "* prevent crash in mod_dav_svn when using SVNParentPath (r1033166)" >  Upstream changeset: >  http://svn.apache.org/viewvc?view=revision&revision=1033166 > > Let's use CVE-2010-4539. > > For

Re: [oss-security] CVE request for subversion

2011-01-05 Thread Josh Bressers
- Original Message - > On Tue, Jan 4, 2011 at 10:02 AM, Jan Lieskovsky > wrote: > > Hello Kurt, Josh, vendors, > > > > Josh Bressers wrote: > >> > >> - Original Message - > >>> > >>> Unspecified vulnerability in the server component in Apache > >>> Subversion > >>> 1.6.x before 1.6

Re: [oss-security] CVE request for subversion

2011-01-04 Thread Hyrum Wright
On Tue, Jan 4, 2011 at 10:02 AM, Jan Lieskovsky wrote: > Hello Kurt, Josh, vendors, > > Josh Bressers wrote: >> >> - Original Message - >>> >>> Unspecified vulnerability in the server component in Apache Subversion >>> 1.6.x before 1.6.15 allows remote attackers to cause a denial of >>> se