Re: Bug#703290: davical: possible code insertion or XSS

[Jonathan Wiltshire <jmw@debian.org>]

On 2013-03-19 07:40, Thijs Kinkhorst wrote:
> On Tue, March 19, 2013 01:37, Christoph Anton Mitterer wrote:
> > severity 703290 important
> > stop
> >
> > On Tue, 2013-03-19 at 10:20 +1300, Andrew McMillan wrote:
> > > Is there any way to do an XSS exploit in 12 characters?  If not, 
> > > then I
> > > don't think this is 'grave'.
> > Unless someone from the security or release team complains I've set 
> > the
> > severity to important.
>
> Agreed that it's not grave until we have a concrete vulnerability at 
> hand.
> The code could/should definitely be more robust, but there's not yet 
> an
> acute issue.

Is it fair to apply this line of reasoning to #703294 also?


--
Jonathan Wiltshire                                      jmw@debian.org
Debian Developer                         http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC  74C3 5394 479D D352 4C51

<directhex> i have six years of solaris sysadmin experience, from
            8->10. i am well qualified to say it is made from bonghits
			layered on top of bonghits