Date: Sat, 8 Aug 2020 12:09:09 +0200 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: Re: Voiding CVE-2020-16248 FWIW while I don't particularly care about the CVE assignment issue, I think there is a valuable discussion to have here. I feel the issue here is that with SSRF there often seems to be some kind of difficulty to pinpoint whether something is actually a flaw or an intended feature and who's to blame. Ultimately these issues come down to this: * There's an expectation that network requests originating from localhost (or from a tightly controlled internal network IP) can be considered trustworthy and are performed by someone/something with some form of local authority. * However that's not necessarily true as you may have many applications that do outgoing network requests that in a variety of ways can be controlled by an attacker. I feel this is somehow also similar to fights between network security thinking and endpoint security thinking that we can see elsewhere. (e.g. the whole TLS interception debate.) -- Hanno Böck https://hboeck.de/
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.