[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

CVEs for malicious software in PYPI

To: cve-editorial-board-list <cve-editorial-board-list@lists.mitre.org>
Subject: CVEs for malicious software in PYPI
From: Kurt Seifried <kurt@seifried.org>
Date: Fri, 15 Sep 2017 18:53:42 -0600
Authentication-results: spf=none (sender IP is 129.83.29.2) smtp.mailfrom=LISTS.MITRE.ORG; mitre.mail.onmicrosoft.com; dkim=none (message not signed) header.d=none;mitre.mail.onmicrosoft.com; dmarc=none action=none header.from=seifried.org;
Delivery-date: Mon Sep 18 07:51:55 2017
List-help: <mailto:LISTSERV@LISTS.MITRE.ORG?body=INFO%20CVE-EDITORIAL-BOARD-LIST>
List-owner: <mailto:CVE-EDITORIAL-BOARD-LIST-request@LISTS.MITRE.ORG>
List-subscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-subscribe-request@LISTS.MITRE.ORG>
List-unsubscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-unsubscribe-request@LISTS.MITRE.ORG>
Sender: <owner-cve-editorial-board-list@lists.mitre.org>
Spamdiagnosticmetadata: 5952c28dcc454f0789fb433d26f936ef
Spamdiagnosticoutput: 1:2

http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/index.html

TL;DR: Someone may PYPI packages that were malicious, and typo/close names of legit things (e.g. acquisition / acqusition). I'd like to assign CVEs to them so they are identified, so two thoughts:

1) people uploaded code (meant to be malicious or not) to PYPI that has flaws, so CVE right

2) the typo squatting aspect, should this get a CVE? There is obvious intent of shenanigans, but... how do we count it?

Kurt Seifried
kurt@seifried.org

Follow-Ups:
- Re: CVEs for malicious software in PYPI
  - From: William Cox <wcox@blackducksoftware.com>
- Re: CVEs for malicious software in PYPI
  - From: Art Manion <amanion@cert.org>
- Re: CVEs for malicious software in PYPI
  - From: Pascal Meunier <pmeunier@cerias.purdue.edu>

Prev by Date: Re: Required information for CVE entry submissions
Next by Date: Re: CVEs for malicious software in PYPI
Previous by thread: CVE Board Meeting Minutes, 6 September 2017
Next by thread: Re: CVEs for malicious software in PYPI
Index(es):
- Date
- Thread