Date: Sun, 15 Jun 2014 11:17:26 -0400 (EDT) From: cve-assign@...re.org To: henri@...v.fi, rich@....org Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE Request for KIO/kmail -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [ actual security content, for people who don't want to read the meta-discussion: Is this related to an https://bugs.kde.org/show_bug.cgi?id=330795 vulnerability? ] > From: Henri Salo <henri@...v.fi> > More details are needed for public CVE request. It might be worthwhile to clarify what problems we're solving, in the specific case of a request by a product's upstream vendor, by requiring that more vulnerability details be sent here at the time of the CVE request. MITRE is almost certainly willing to accept this as a valid reason, if there's general agreement: - people here don't want to see announcements of vulnerabilities that are both vague AND unfixed, and would just unsubscribe if there were many of these (vague vulnerability details for fixed issues typically haven't had objections in the past, e.g., the http://openwall.com/lists/oss-security/2013/11/28/5 post) (In 2013 and earlier, vulnerability details here had a de-duplication purpose for MITRE, but they often don't now. If we were to assign a CVE ID for this, we'd already know whether any kio CVE requests had been sent directly to us. The CVE-OpenSource-Request-HOWTO.html page and examples aren't directly applicable to us, and we're generally more concerned with knowing whether something is a unique issue that everyone will want to fix, than with knowing every possible detail. But we realize the list charter may imply a minimum level of details.) Going back to the security content, KDE Bug 330795 mentioned above says: Product kio KDE's KIO completely ignores the first part, "must not automatically redirect without prompting the user" and possibly this is (or was) a violation of RFC 7231 section 6.4, with security implications: "Automatic redirection needs to done with care for methods not known to be safe, as defined in Section 4.2.1, since the user might not wish to redirect an unsafe request." Does anyone want a CVE ID for that? Finally, for the original "a vulnerability in KIO that causes a security issue in kmail" request: to get a CVE ID for this more quickly, please send to cve-assign@...re.org mentioning whether it is or isn't Bug 330795. We don't want to send a CVE ID here immediately because MITRE doesn't determine the list charter and it might be an off-topic request. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJTnbf4AAoJEKllVAevmvmshwcIAKsAvHDSJ+5WtN/KHSRnmjnh 478KbPSDqk1kbQ+rAtJ+BuylsiWICfk8UYv9u3guqzI3wkqXRRewTdd8N+pHK2Ri nkV0UdM5Q/jFvfm4cD3ZzCH0Arp0Yu5e2Ps/kCag/MODmsCg+TMgMzXw3tdTh1cc 1aHo7lJrWZmc1WT5w4O6wEkaRTns0TRvpVstZmOUZXTSaSBNyy+4lofE8MV4580x K7ov/NF0Ti9PrT9yhRhIJq+vFumc7C9TkPL1qWOsXXD1qyXZBnOuRZjMLGjXacy7 vWXAKQ1uVmVTLeO0edQze0BxNYz/gVsnRhuS8/vFXX6JhFScISofaBEpMMwwhgQ= =1F5O -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.