Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 2 Jan 2014 14:45:05 -0500 (EST)
From: cve-assign@...re.org
To: dkg@...thhorseman.net
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, fweimer@...hat.com
Subject: Re: kwallet crypto misuse

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Thanks very much for this additional information. At this point, it
seems very unlikely that the "\0a\0b\0c\0d" issue will have an
additional CVE assignment. We were asking just because of the
possibility of a clear implementation error in which security was
weakened by using a "wrong" character width.

> Do you think MITRE or other folks should be recommending pre-whitening
> the strings before encrypting them

It's possible that a group elsewhere at MITRE would work on
recommendations in that area or other areas. For purposes of the CVE
assignments in this situation, that type of opportunity for security
improvement wasn't being considered.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJSxcEIAAoJEKllVAevmvmsyJoH/R/Z4u6+P/T7Hk3Mj0h1nidp
cmG3PUnqQFSzYwWoo3NIst8KTpt1MZQmbAtfTkY3w2hEpqwbQk18pNLzY+lcUFIr
wamgvXoyWPOYNcp7NypQfHoRQOT9TdFjhIxJXy9R1VLqfyeubs19uN+iYILDS+ik
BgdStB2F1geISFG6M+hO+WtFouk61b5ZaC5ejEjkkEs7U6LQnRcF4WxNmZ3ym2ml
zO/kSfpUpzgjMurtRbBFhuh13L2Ohl0nxiizsUv735JH5aL+TX7V8d1B/+11ZXTs
RP85J3qyCRYswi0oaCLhOx4Qv/YcUZlCJZIHyTb7seJvJShV6xclQunJD3GFZDU=
=YscU
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ