Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 26 Jun 2014 17:45:10 +1000
From: Murray McAllister <mmcallis@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: Question regarding CVE applicability of missing
 HttpOnly flag

On 06/26/2014 05:38 PM, Henri Salo wrote:
> On Thu, Jun 26, 2014 at 05:30:46PM +1000, Murray McAllister wrote:
>> But websites set lots of cookies, which if stolen, have no relevance
>> to being able to access the user's session, or do much of anything
>> useful with anyway. I believe a lot of the "this cookie does not
>> have HTTPOnly" issues are non-issues.
>
> Those CVEs should be REJECTED. Can you provide list of non-issues with CVE?
>
> ---
> Henri Salo
>

I was not clear, sorry. I had not looked at the original CVEs, and was 
just talking in general: Red Hat has 
https://access.redhat.com/site/articles/66234 and we get a lot of 
httponly related reports (assuming others get them too).

Cheers,

--
Murray McAllister / Red Hat Product Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.