Bug#904215: civicrm: CIVI-SA-2018-07: Remote Code Execution in Quickform

2020-01-02 Thread Dmitry Smirnov
On Thursday, 2 January 2020 7:50:39 PM AEDT Salvatore Bonaccorso wrote: > > https://wiki.debian.org/UpstreamGuide > > Ah I see there was already a mentioning of requesting CVEs *but* it > was pointing to a not anymore available site of poeple.redhat.com, I > updated the reference to >

Bug#904215: civicrm: CIVI-SA-2018-07: Remote Code Execution in Quickform

2020-01-02 Thread Salvatore Bonaccorso
Hi On Thu, Jan 02, 2020 at 06:57:39PM +1100, Dmitry Smirnov wrote: > On Thursday, 2 January 2020 6:20:23 PM AEDT Salvatore Bonaccorso wrote: > > The good thing on having a CVE id for the vulnerabilities is helping > > other vendors to track the issues properly 'cross-vendor' in an unique > > way.

Bug#904215: civicrm: CIVI-SA-2018-07: Remote Code Execution in Quickform

2020-01-02 Thread Dmitry Smirnov
On Thursday, 2 January 2020 6:20:23 PM AEDT Salvatore Bonaccorso wrote: > The good thing on having a CVE id for the vulnerabilities is helping > other vendors to track the issues properly 'cross-vendor' in an unique > way. If every upstream would use individual identifiers to track their >

Bug#904215: civicrm: CIVI-SA-2018-07: Remote Code Execution in Quickform

2020-01-01 Thread Salvatore Bonaccorso
Hi Dmitry! On Thu, Jan 02, 2020 at 10:38:09AM +1100, Dmitry Smirnov wrote: > Closing obsolete bug... > > On Sunday, 22 July 2018 5:11:39 AM AEDT Salvatore Bonaccorso wrote: > > https://civicrm.org/advisory/civi-sa-2018-07-remote-code-execution-in-quick > > form > > > > This is already fixed, so

Bug#904215: civicrm: CIVI-SA-2018-07: Remote Code Execution in Quickform

2018-07-21 Thread Salvatore Bonaccorso
Source: civicrm Version: 4.7.30+dfsg-1 Severity: grave Tags: security upstream Control: fixed -1 5.3.1+dfsg-1 https://civicrm.org/advisory/civi-sa-2018-07-remote-code-execution-in-quickform This is already fixed, so this bug is to track the issue in the BTS. No CVEs seem to be assigned for the