Date: Mon, 05 Aug 2019 13:36:54 +0200 From: Florian Weimer <fweimer@...hat.com> To: oss-security@...ts.openwall.com Subject: Current CVE policy on missing-hardening bugs What's the current policy on assinging CVE IDs for bugs that are merely missed hardening opportunities? One example is lack of full ASLR due to address space limits (47 or fewer bits instead of the theoretical limit of 64 bits). Are they eligible for CVE assignment? Should we DISPUTE them if we encounter them? Thanks, Florian
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.