Date: Thu, 15 Jun 2017 10:28:04 -0700 From: Kurt H Maier <khm@...ops.net> To: oss-security@...ts.openwall.com Subject: Re: Re: MySQL - use-after-free after mysql_stmt_close() On Thu, Jun 15, 2017 at 08:21:29AM -0600, Kurt Seifried wrote: > 1) Official documentation that says "do this [insecure thing]" should > probably get a CVE (e.g. "turn off all the encryption to make it work more > easily"). This should probably get a CVE, especially as it results in > operational changes which won't get a CVE (since it's not in code that > "ships", it's just on the end of whoever is using it). I really like this idea. What would be the approach to software whose documentation starts out with "turn off selinux," out of curiosity? Obviously this lessens the security stance of the system, but presumably the system is designed to be operable without selinux. Would CVEs get assigned for all bad ideas, or just those that expose actual attack vectors? > 3) Unofficial but commonly used documentation and code examples, I guess > the best example here is stackoverflow and friends? This is going to cause you to hit INT_MAX relatively quickly. khm
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.