[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1201171650350.16209@faron.mitre.org>
Date: Tue, 17 Jan 2012 17:00:35 -0500 (EST)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
cc: Henri Salo <henri@...v.fi>
Subject: Re: Re: pwgen: non-uniform distribution of passwords
On Tue, 17 Jan 2012, Kurt Seifried wrote:
> In this case we have something that tells you not to use an unsafe
> option but isn't exceedingly noticeable or clear (if it came up every
> time you used that option there would be a stringer case for no CVE).
> I'm sitting on the fence for this one (I can see it going either way),
> wouldn't mind some more opinions from the smart people on this list.
For CVE, if there is an insecure feature that is documented, but there are
likely or proven scenarios in which an admin might be unaware of the
insecurity of the feature, then we will often consider it for inclusion.
In this case, we would write the CVE description in a way that emphasizes
the admin's role in creating/introducing the issue.
A separate reason for inclusion would be if a product advertises a
security feature, but the implementation does not achieve the claimed
level of security.
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
