Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 8 Aug 2020 12:09:09 +0200
From: Hanno Böck <>
Subject: Re: Voiding CVE-2020-16248

FWIW while I don't particularly care about the CVE assignment issue, I
think there is a valuable discussion to have here.

I feel the issue here is that with SSRF there often seems to be some
kind of difficulty to pinpoint whether something is actually a flaw or
an intended feature and who's to blame.

Ultimately these issues come down to this:
* There's an expectation that network requests originating from
  localhost (or from a tightly controlled internal network IP) can be
  considered trustworthy and are performed by someone/something with
  some form of local authority.
* However that's not necessarily true as you may have many applications
  that do outgoing network requests that in a variety of ways can be
  controlled by an attacker.

I feel this is somehow also similar to fights between network security
thinking and endpoint security thinking that we can see elsewhere.
(e.g. the whole TLS interception debate.)

Hanno Böck

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.