Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 5 Feb 2013 12:45:48 -0500 (EST)
Subject: Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations

Hash: SHA1

>cc'ing cve-assign to see if they can provide some guidance here.  I also
>noticed that OpenSSL has a CVE for this (I'm assuming that the
>CVE-2012-2686 issue is _not_ the same thing, but that CVE-2013-0169 is
>this issue).
>Since it's a weakness in TLS/DTLS itself, from my understanding, and not
>necessarily in a particular implementation, I'm not sure if this
>qualifies as one CVE for the weakness, or if it needs one per
>MITRE, can someone provide some guidance on this?

[ This is mostly directed to Red Hat at this point. We'll expand to
the other recipients or vendors later. ]

We're not exactly sure that MITRE has the next step here. A CVE
exists, CVE-2013-0169, that was issued by the Red Hat CNA. When the
CVE assignment was made, presumably one or more persons at Red Hat had
a working understanding of what the name CVE-2013-0169 means. (For
example: was the CVE assigned with a multi-vendor scope in mind? Was
the CVE assigned to cover the entirety of the content of the research paper?) MITRE would, in
general, want to preserve this original meaning if it makes sense to
do that. Because there's no specific statement on this list about what
CVE-2013-0169 means, we'd next go to

to see if that may be a canonical statement of what CVE-2013-0169
means. But there's nothing there yet.

Before offering a guess from MITRE, we'll wait for some more

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through ]
Version: GnuPG v1.4.11 (SunOS)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.