Date: Tue, 7 Oct 2014 16:35:00 -0400 (EDT) From: cve-assign@...re.org To: kseifried@...hat.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: Discussion: information leakage from server and client software - CVE/hardening/other? -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The main cases in which a CVE could exist are: 1. The author of the software states that the information-leakage behavior was a violation of the product's security policy. 2. The information-leakage behavior directly contradicts the product's documentation stating that the specific information leakage doesn't occur. 3. The author of the software makes no statement, but all (or nearly all) similar products follow a standard practice in which the information-leakage behavior doesn't occur. For example: common web browsers don't send a file: URL in a Referer header. 4. The author of the software makes no statement, and disclosing the information results in no benefit to the user, and the information would not be useful to the vendor in further developing the product or complying with restrictions on the data that the vendor offers in conjunction with the product. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJUNE1sAAoJEKllVAevmvmsfGwIAK3AZYGPKsOQhdaAorKi8Bly SFuaSXCjmhkswmH74fN11UCmU4OWwV+3Vv66iE/YGpZDk4j1yFJR3fYLTeTcYCuH xTPyAbsBI4UcrcNtay9iujUgcXe7lRxc8b8E2l962dEm3Xw1FzzFUUtC+kVUCoyR 4qHWsS+1eUIZ7+q6L5ITG12K4hvYHwGRDzr08+IvESfmvskgc3tCEgV/eHa009Rs rM/M6o9EE0CEyDCyhFk4LiZgSq8UjG5lJCMP4aeA8t43eSNGeWSSXnaZIwOiPwsC UNl4GDN3Ro1+WPumX6fiJmXVq/h5B7S5oCBjPyjUOsz2ZI9Kce+T9Dug3l/PtU0= =wGXw -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.