https://bugzilla.redhat.com/show_bug.cgi?id=2011190
Jonathan Christison <jochrist(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Comment|9 |updated
--- Comment #9 has been edited ---
Marking this flaw as having a Moderate impact (was Important) as per Red Hat
security ratings -
"This rating is given to flaws that may be more difficult to exploit but could
still lead to some compromise of the confidentiality, integrity or availability
of resources under certain circumstances. These are the types of
vulnerabilities that could have had a Critical or Important impact but are less
easily exploited based on a technical evaluation of the flaw, and/or affect
unlikely configurations."
This is based on the flaw requiring some prerequisites which we think are
unlikely to occur in applications using Santuario, namely that unprivileged
users would be able to manipulate XML to inject the retrievalMethod element and
that XPath transformations also be under the attackers control.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2011190