[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID:
<ME0P300MB07138B071567B325B2498105EE1BA@ME0P300MB0713.AUSP300.PROD.OUTLOOK.COM>
Date: Mon, 29 Sep 2025 03:57:52 +0000
From: Peter Gutmann <pgut001@...auckland.ac.nz>
To: Damien Miller <djm@...drot.org>, "Adiletta, Andrew" <ajadiletta@....edu>
CC: Theo de Raadt <deraadt@...nbsd.org>, Solar Designer <solar@...nwall.com>,
"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
"openssh@...nssh.com" <openssh@...nssh.com>, "Tol, Caner" <mtol@....edu>,
"Sunar, Berk" <sunar@....edu>, "Doroz, Yarkin" <ydoroz@....edu>, "Todd C.
Miller" <Todd.Miller@...rtesan.com>
Subject: Re: [EXT] Re: CVE-2023-51767: a bogus CVE in OpenSSH
Damien Miller <djm@...drot.org> writes:
>The fact that someone filed this CVE based on your paper demonstrates that it
>is misleading.
Everyone gets that at some point. There was a discussion on another mailing
list about it a while back, how do you respond to a CVE for a vulnerability
that doesn't exist unless you modify the code or config in order to create it?
The general feeling was that it's best just to grin and bear it, you're going
to get them at some point no matter what you do. In particular, some obscure
vuln that no-one will ever exploit only becomes publishable if you demonstrate
it against a well-known project like OpenSSL, or OpenSSL, or OpenSSL, or
OpenSSL, maybe GPG, or OpenSSL, and occasionally OpenSSH. But almost always
OpenSSL.
The only complication I've run into was when I was contacted by a user asking
whether the problem in CVE xyz had been fixed. That was the first time I'd
heard about it (the person who filed the CVE never bothered contacting me),
and then I had to figure out how to explain to them that there was no fix
because the vulnerability didn't exist unless you added it yourself.
Peter.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
