Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 04 Sep 2013 11:25:21 -0400
From: Daniel Kahn Gillmor <>
Subject: Re: CVE request: unauthorized host/service views displayed
 in servicegroup view

[dropping cc's, just leaving oss-security]

On 09/03/2013 07:02 PM, Vincent Danen wrote:

> I mean, if someone wants to shoot themselves in the foot and document it
> as a feature, who are we to say otherwise?  We may not agree with it,
> but it's a documented feature (deliberately changed), so we can't just
> very well call it a security flaw because we don't like the new
> behaviour.

I'm curious about this.  If, say, a modern TLS library some day decides
to get around to implementing (old, deprecated, known-insecure,
previously-unimplemented) SSLv2, and announces it as a feature, and
enables it by default, is the consensus of this group that we would not
treat it as worthy of a CVE, despite being a clear security weakening?

At what point does the security community override the upstream
decisions and declare the packages vulnerable?


Download attachment "signature.asc" of type "application/pgp-signature" (1028 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.