Date: Tue, 11 Mar 2014 07:41:59 -0400 (EDT) From: cve-assign@...re.org To: hanno@...eck.de Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: When is broken crypto a vulnerability? -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 >> It's not completely clear what you mean. If it were a logic error in >> the code, e.g., menu choice 2 of "AES encryption" is selected but the >> code calls the function intended for menu choice 1 of "standard >> encryption," then a CVE could be assigned to the specific codebase >> that has that logic error. > Yes, that's exactly what I meant. > One product, it's already disclosed to the vendor and I will publish > details shortly. So we agree this one gets a CVE. This logic error issue was assigned CVE-2014-2319. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTHvSnAAoJEKllVAevmvmsXL8IALjFY7yhR0nyZDyqv7Wpi0DQ F9ie5JCp4JINw8WDVZys78L7Ssquakc6I1jEOhOkbCSlmFM3DJ4bCRbZgr8Fl+hV Llu0zDKGK4u5s6Dgx4kBgwQkN/5VKfjTLtNuCNHr1FWPVPYbRnskTQTnbWljYpfC ovGAx+7ZaSyomyZ701TOSEVocsSPVo/Oppfb6P7InsurGQx+V8ZQI0xO89fuffZ/ NdnaBnGicj/i7XAh9ibGE++JDN2wvXmwHraK2z1plKx+eEfFt6174yu4DkcsYcHR 4tztg+5lNsVr7d9BK5y8fCYI777M+ajShDZnkqMAxoPgaOgoExZS/YQVOusfReg= =SgGd -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.