Date: Tue, 5 Feb 2013 23:36:34 +0800 From: Shawn <citypw@...il.com> To: oss-security@...ts.openwall.com Cc: nadhem.alfardan.2009@...l.ac.uk, kenny.paterson@...l.ac.uk Subject: Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations hi Matthias, On Tue, Feb 5, 2013 at 5:34 PM, Matthias Weckbecker <mweckbecker@...e.de> wrote: > Hi, > > has there already been a CVE assigned for the recent "lucky 13" timing > flaw that affects various SSL / TLS implementations (including GnuTLS)? > > http://www.isg.rhul.ac.uk/tls/ > http://www.gnutls.org/security.html#GNUTLS-SA-2013-1 > > I think this could qualify for CVE for each open source implementation > that's prone. > According to "OpenSSL Security Advisory [05 Feb 2013]": http://www.openssl.org/news/secadv_20130204.txt It seems already had a CVE-id. But I couldn't find by googled... -- GNU powered it... GPL protect it... God blessing it... regards Shawn
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.