Date: Tue, 1 Mar 2016 12:25:24 -0700 From: Kurt Seifried <kseifried@...hat.com> To: CVE ID Requests <cve-assign@...re.org> Cc: oss-security <oss-security@...ts.openwall.com> Subject: Re: CVE's for SSLv2 support On Tue, Mar 1, 2016 at 12:12 PM, <cve-assign@...re.org> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > > If a crypto library (e.g. OpenSSL, NSS) supports AND enables SSLv2 by > > default should it receive a CVE? > > There's no general answer to that question. CVE ID assignments are not > based on outsiders making guesses about the expectations of a product's > customers. For example, there might be a crypto library intended for > communication on isolated networks to high-value embedded devices that > support only SSLv2, and cannot and will not ever be updated. > > I guess my confusion is: what would be the downside to assigning a CVE in such a case, such a "false positive" would be easily explained ("yes we support SSLv2, but only for use on closed network") but more to the point by drawing a line in the sand of "SSLv2 is worth a CVE" we'd be much more easily able to track which products are using SSLv2 by default (and thus putting us at risk). From your web page "CVE is a dictionary of publicly known information security vulnerabilities and exposures." Does SSLv2 not pretty much exactly fit this definition now?  which begs the question why they're even using SSLv2 but I digress =) -- -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.