Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 22 Mar 2015 15:25:53 +1100
From: Michael Samuel <>
Cc: Assign a CVE Identifier <>
Subject: Re: CVE for Kali Linux


On 22 March 2015 at 13:27, Kurt Seifried <> wrote:
> So I guess we enter uncharted territory here. So my thought is this:
> Vendor has front page that recommends doing something completely insane
> and insecure (http/md5s/etc.). On the back end (good lucking finding
> this) vendor does something sort of secure (gpg signing of packages, no
> clue if key distribution is secure) but this is not really documented well.

Securely distributed md5 and sha1 hashes are just fine against third-party
attackers unless you can think of a way in which an attacker could set up a
collision ahead of time.

There have been attacks against dpkg that work prior to GPG sig checks,
as well as attacks against GPG itself.   But then again, TLS stacks aren't
exactly bug-free.

> Does this win a CVE or not? I personally think yes, yes it does.

If any of those circumstances come up, I expect CVEs to be assigned,
but other than that any changes here are just hardening.  Something like might be a good start, but I
don't know what the browser takeup is.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.