Date: Mon, 24 Feb 2014 09:02:58 -0500 (EST) From: cve-assign@...re.org To: mhall@...omputing.net Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: Fwd: temporary file creation vulnerability in Redis -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > I can understand and accept this view even though I might see it a > differently. We recognize that there's a significant number of issues that fall into the general category of "it could be useful to draw attention to this aspect of a security model, because the documentation is arguably inconsistent or obscure, and this may result in risks to end users." Currently, the scope of CVE identifiers doesn't really extend to these types of "useful to draw attention" identifiers. What we can do is assign a CVE ID if any vendor bundles a copy of Redis with a default directory of /tmp, and decides to make a security announcement about that. We feel there's a distinction between "there's nothing stopping an end user from choosing a world-writable dataset directory" and "it ships world-writable." - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTC0+NAAoJEKllVAevmvmsMqwH/j7Kwt5y6kN92u2JFeb/irRH NLXMhSMS+tLwrFlOdHDT+6P/pz7MqR+3qH5aSQoV38F92UvMD5VsSjYufczFJjBv 8uerZbJRZ3pE+07zgAoqI0DmWGqbCEHRDjCwuWiOh7Mc1Ww9Uvvz9Ubrze5QKB2t 6TlAMWuWkfqAlJDCjXjhN+vXhAyfpjl4HHlIYSJj0VQhC0gr14Ygp0FQWR/e75/h mzrOi3/9YKJIodN3T9kDk3BoSBBXhXmWxpXIOjGahEAZteWAiPmHZkYTXiJWhSRo EhTqrItQyJk8AxNXrojhnPQaFe3b04UPH+fs85FLCfRkH6orWTBfYVgYo6qXf30= =Gvye -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ