Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 14 Nov 2010 10:05:07 -0500
From: Marc Deslauriers <>
Cc: Bill Janssen <>, Andreas Hasenack
 <>, Mads Kiilerich <>, "Steven M.
 Christey" <>
Subject: Re: CVE Request -- Mercurial --Doesn't verify
 subject Common Name properly

On Mon, 2010-10-11 at 15:48 -0400, Josh Bressers wrote:
> Steve,
> Can I defer this one to MITRE? My initial thought is that python should get
> the ID, but they seem to want to push it up to the application developers,
> but they also added some functionality in
> Is there a past precedent for this?

Has any decision been made regarding CVE assignment for this? I've found
some more python applications that aren't validating ssl certs, and am
waiting to know how this is going to be handled.



Marc Deslauriers
Ubuntu Security Engineer     |
Canonical Ltd.               |

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.