[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 19 Jul 2011 15:28:17 +0200
From: dfncert@...-cert.de
To: Tomas Hoger <thoger@...hat.com>
Cc: oss-security@...ts.openwall.com, dfncert@...-cert.de,
aland@...eradius.org
Subject: Re: CVE request: vulnerability in FreeRADIUS (OCSP)
On Tue, Jul 19, 2011 at 03:13:00PM +0200, Tomas Hoger wrote:
> > Are the published information sufficient to get a CVE number for the
> > issue?
>
> Was your intention to request a CVE for a still-to-remain-non-public
> issue to be disclosed in the future, or actually make the issue public?
We plan to make the issue public as soon as we have a CVE and can publish
our advisory. However, almost every detail of the vulnerability has been
already discussed on this list.
(Summary: the status of the certificate will not be checked)
Thus, the patch does not reveal any further aspects of the vulnerability and
the only reason that we do not want to publish it publicly is that the fact
that it may be incomplete and/or introduce side effects because we do
not have a complete test environment.
> I'm CCing upstream (Alan DeKok), as it seems this thread may be giving
> out more info than expected. Alan, this is part of the following
Good idea.
p.s.
Please include us in CC since we are not subscribed on the list.
--
DFN-CERT Services GmbH, https://www.dfn-cert.de/, Phone +49 40 808077-555
Sitz/Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737
Sachsenstraße 5, 20097 Hamburg/Germany, CEO: Dr. Klaus-Peter Kossakowski
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
