<div dir="ltr"><span style="font-family:arial,sans-serif;font-size:13.333333969116211px">Hi everyone, sorry, I did not see that there were people CC'd on the original email. </span><div><font face="arial, sans-serif"><br>
</font></div><div><font face="arial, sans-serif">Following on to what I emailed in response to Kurt (included after this email), here is the response I got when I submitted information about the similar Ruby on Rails vulnerability to the Vulnerability Analysis Team at the </font><span style="color:rgb(0,0,0);font-family:arial,sans-serif;font-size:13.333333969116211px;white-space:nowrap">CERT(R) Coordination Center:</span><font face="arial, sans-serif"><br>
</font><div>
<span style="font-family:arial,sans-serif;font-size:13.333333969116211px"><br></span></div></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div><span style="font-family:arial,sans-serif;font-size:13.333333969116211px">We appreciate you reporting this issue to us. We are tracking this issue as VU#160862. Please be sure to include VU#160862 in the</span></div>
</div><div><div><span style="font-family:arial,sans-serif;font-size:13.333333969116211px">subject when replying to this email.</span></div></div><div><div><br style="font-family:arial,sans-serif;font-size:13.333333969116211px">
</div></div><div><div><span style="font-family:arial,sans-serif;font-size:13.333333969116211px">Since you have already made this </span><span style="font-family:arial,sans-serif;font-size:13.333333969116211px">vulnerability</span><span style="font-family:arial,sans-serif;font-size:13.333333969116211px"> public, we do not feel that coordination is necessary at this point.</span></div>
</div><div><div><span style="font-family:arial,sans-serif;font-size:13.333333969116211px">We encourage you to work directly with the </span><span style="font-family:arial,sans-serif;font-size:13.333333969116211px">Ruby</span><span style="font-family:arial,sans-serif;font-size:13.333333969116211px"> on </span><span style="font-family:arial,sans-serif;font-size:13.333333969116211px">Rails</span><span style="font-family:arial,sans-serif;font-size:13.333333969116211px"> security team to resolve this issue.</span></div>
</div></blockquote><div class="gmail_extra"><br clear="all"><div><div>Hope this helps. Again, do not hesitate to reach out for any information you might need for the Django or Rails vulnerabilities.</div><div><br>Thanks!</div>
<div><br></div><div>G. S. McNamara</div><div><br></div></div><div><br></div><div class="gmail_quote">On Thu, Oct 3, 2013 at 9:14 PM, G. S. McNamara <span dir="ltr"><<a href="mailto:main@gsmcnamara.com" target="_blank">main@gsmcnamara.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div dir="ltr">Hi Kurt,<div><br></div><div>If you could assign a CVE that would be great. </div><div><br></div><div>I did not attempt to with this disclosure because my previous disclosure of a similar issue with the Ruby on Rails framework detailed here (<a href="http://maverickblogging.com/logout-is-broken-by-default-ruby-on-rails-web-applications/" target="_blank">http://maverickblogging.com/logout-is-broken-by-default-ruby-on-rails-web-applications/</a>) was rejected on account of me publishing the information publicly.</div>
<div><br></div><div>I'd love to provide you whatever information you need for the CVE.</div><div><br></div><div class="gmail_extra"><div><div><br>Thanks!</div><div><br></div><div>G. S. McNamara</div><div><span style="font-size:x-small"><br>
</span></div><div><span style="font-size:x-small">Founder & Head Hustler | Inc.less, An Ideas Company | </span><span style="font-size:x-small"><a href="tel:%2B1%20%28202%29%20507-9703" value="+12025079703" target="_blank">+1 (202) 507-9703</a></span> <span style="font-size:x-small">| Washington, D.C. | </span><a href="http://www.linkedin.com/in/GSMcNamara" style="font-size:x-small" target="_blank">Linkedin</a><span style="font-size:x-small"> | </span><a href="https://twitter.com/GSMcNamara" style="font-size:x-small" target="_blank">Twitter</a></div>
</div><div><div>
<br><br><div class="gmail_quote">On Thu, Oct 3, 2013 at 9:11 PM, Kurt Seifried <span dir="ltr"><<a href="mailto:kseifried@redhat.com" target="_blank">kseifried@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
On 10/02/2013 03:09 AM, Jeffrey Walton wrote:<br>
> Not sure if this made anyone's radar....<br>
><br>
> (I'm not sure about the 1.7 version, though).<br>
><br>
> ---------- Forwarded message ---------- From: G. S. McNamara<br>
> <<a href="mailto:main@gsmcnamara.com" target="_blank">main@gsmcnamara.com</a>> Date: Tue, Oct 1, 2013 at 4:20 PM Subject:<br>
<div>> [Full-disclosure] [Django] Cookie-based session storage session<br>
</div>> invalidation issue To: <a href="mailto:full-disclosure@lists.grok.org.uk" target="_blank">full-disclosure@lists.grok.org.uk</a><br>
<div><div>><br>
> FD,<br>
><br>
> I’m back!<br>
><br>
> Django versions 1.4 – 1.7 offer a cookie-based session storage<br>
> option (not the default this time) that is afflicted by the same<br>
> issue I posted about previously concerning Ruby on Rails:<br>
><br>
> If you obtain a user’s cookie, even if they log out, you can still<br>
> log in as them.<br>
><br>
> The short write-up is here, if needed:<br>
> <a href="http://maverickblogging.com/security-vulnerability-with-django-cookie-based-sessions/" target="_blank">http://maverickblogging.com/security-vulnerability-with-django-cookie-based-sessions/</a><br>
><br>
> Cheers,<br>
><br>
> G. S. McNamara<br>
<br>
</div></div>Sounds like this needs a CVE? Has one been requested from Mitre? If<br>
not I can assign it.<br>
<br>
<a href="https://people.redhat.com/kseifrie/CVE-OpenSource-Request-HOWTO.html" target="_blank">https://people.redhat.com/kseifrie/CVE-OpenSource-Request-HOWTO.html</a><br>
<br>
- --<br>
Kurt Seifried Red Hat Security Response Team (SRT)<br>
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.14 (GNU/Linux)<br>
<br>
iQIcBAEBAgAGBQJSThXbAAoJEBYNRVNeJnmTeGMQAI4jnGSqKxP0vC1nPj4WAYyl<br>
leYsGVX/SmZ1LX7s0KNbmbuN9ERcA5zT7ua7J0osMuPnhkODb7z/dhWuYnZARDIn<br>
nVEaLJyBa6Bu7rcsasgFmuHk4BvXwnEY0ngH/i3Dz/jIxrP3atSr8uaQW8fdVtP1<br>
FkVKx+NDaqEuHjJTpy8snO0UYPj9ZE/gS2Hs9ydyIRyeMGrSspdsnrzI7bxaMejq<br>
pMcu41fH7kZZ3tseUyhc+oBzOzHDlWHYVuJJL/DCuk64RMOPGrp7zyLBoDF3U3gm<br>
u5C85OoIpTCl5XuOE2LLO2kotfCnP2PfUdMm+KdzS9tpTkMtOc6KJFjn6MeohYKN<br>
/TxT+m1rQqEmipxMbFgXc6pulZSEUWEnhy599960aoSmKUPN1Ss9sXK4ARwkfaeA<br>
04L5JLcwocc3g0uHhNayx29ilF3Jsj97SBHUEiaqoe4dBTKumFdv14b61nAJknYd<br>
PA3pCq9/3j1R5r+kDK9lffPjeycL/gaqHoXTH3sTdwExFeuBTPXC0kEeqH/GngWD<br>
U60cSGkr+LVH2z2AF5qRyEjGPOR0QFuE4zo072L+5fFavftgMvLvukkAXTTz/V6C<br>
9ljGyTJ+nA02NKKylAAP7hLksRuKgyQIx/dKK2Btqlb0ZlU/C1igmoyL3JVocIMt<br>
7EuS8NbgPBnQnSYuQ14I<br>
=whZK<br>
-----END PGP SIGNATURE-----<br>
</blockquote></div><br></div></div></div></div>
</blockquote></div><br></div></div>