Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 4 Sep 2013 21:19:19 -0400 (EDT)
From: Vincent Danen <>
To: "" <>
Cc: "" <>
Subject: Re: CVE request: unauthorized host/service views displayed in servicegroup view

That somewhat proves my point.
=). In both cases you're talking about intended security being violated or a security-relevant mistake.  I don't see how relaxing ACLs intentionally, but still protected via authentication, meet either criteria.

Vincent Danen / Red Hat Security Response Team

On 2013-09-04, at 5:08 PM, wrote:

> Hash: SHA1
>> I think the first question is what constitutes a security flaw --
>> once that is defined, then I think what upstream does is irrelevant.
>> If it's a flaw, it's a flaw.
> CVE assignment by MITRE doesn't look at flaws in quite that way. If a
> vendor has developed and released software and then sends us a report
> that the software had a security-relevant mistake, or violated that
> vendor's intended security policy, that's usually enough for a CVE.
> Reports from third parties are viewed much more restrictively.
> - -- 
> CVE assignment team, MITRE CVE Numbering Authority
> M/S M300
> 202 Burlington Road, Bedford, MA 01730 USA
> [ PGP key available through ]
> Version: GnuPG v1.4.14 (SunOS)
> mVCfX+dzdvgsl3vr8r2aDL+K7hHV7RMwUial7ioyOCruTvtvBTRfssXcJrcLzLSF
> zejR2luTtNNzFIVbjc134gDOis9/Xr2dPwheP0RNHBFRI655tnCWt+gIisPhJujz
> E/FfW67K7up0/c+dDuzgdHfO1n+PG0Us3SdAnQwKGS181agM4flsWL64XXaITFs4
> 0Xx8l6UPN6G7ybMikJlsUbiLQZ70au6W0eEqTCvuLILbx0oEFRK47cLxGJSn190N
> lOIh5F1YwVPeZivXjEc0kdFxY+pypc8v1AxXHzQnzwap+wtxsshmgyadqiiiXD8=
> =5ycL

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.