Date: Wed, 3 May 2023 15:41:26 -0400 From: Jeffrey Walton <noloader@...il.com> To: oss-security@...ts.openwall.com Subject: Re: Perl's HTTP::Tiny has insecure TLS cert default, affecting CPAN.pm and other modules On Wed, May 3, 2023 at 3:21 PM Reid Sutherland <reid@...rddimension.net> wrote: > On 4/29/23 06:04, Stig Palmquist wrote: > > > > - CVE-2023-31484 for CPAN.pm > > - CVE-2023-31485 for GitLab::API::v4 > > - CVE-2023-31486 for HTTP::Tiny > > ... > > Who actually decides when something receives a CVE? This can be used to > defame projects and products as in this case. "Who decides" can be a tricky question. Several organizations issue CVEs, like Red Hat and Gentoo. A bug usually has to meet a criteria, like falling into a CWE category, to be issued by the organization. You can also get them from Mitre's site. In the case of Mitre, it is the person who requests the CVE. Some CVE's are tenuous or questionable. You often see this from folks trying to pad their resume. For example, a researcher may request a CVE for a behavior that requires elevated privileges. In this case, someone who is Root on Linux or Administrator on Windows can already do the damage, so the behavior in question that happens with privileges is not really interesting. In the case of HTTP::Tiny, the default configuration and behavior is running afoul of https://cwe.mitre.org/data/definitions/295.html and https://cwe.mitre.org/data/definitions/319.html. In this case, the industry believes comms should use HTTPS and the name hostname should be validated. Jeff
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.