Date: Tue, 11 Aug 2015 14:58:10 +0200 From: Adam Maris <amaris@...hat.com> To: oss-security@...ts.openwall.com Subject: Re: CVE for crypto_get_random() from libsrtp On 11/08/15 13:48, Jeremy Stanley wrote: > On 2015-08-11 09:51:50 +0200 (+0200), Adam Maris wrote: > [...] >> Unless CVE is assigned, we don't plan to ship any patch at the moment. > I find this an interesting stance. Don't you decide on your own > whether your customers are impacted by a bug sufficiently to require > a fix (security vulnerability or otherwise)? It seems reasonable to > me that you would choose whether or not to ship a patch > independently of how MITRE chooses to classify (or not) the > associated bug... and vice versa, if a CVE is assigned for a bug you > consider to have minimal impact, do you release a patch for it > anyway just because there's a CVE? This has nothing to do with us not fixing flaws just because they don't get a CVE. I assure you that we've fixed security flaws that had no CVEs before. And if you look through our CVE database, you'll find many examples of simple crashers that unfortunately got a CVE, which we did not fix. The main reason for not fixing it for now is that we think 80 bits of randomness is enough for most applications up to this day, especially if it's session data and not permanent storage, etc. Therefore we classify this issue as having a Low security impact. If a CVE is assigned for this issue, we will create an entry in our CVE database but the end result will likely be the same, wontfix. -- Adam Maris / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.