[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAH8yC8mJHfyn1YGpoSWwNs1nFkWnu8pL7KsO9-sTKDrtu8QR+g@mail.gmail.com>
Date: Wed, 3 May 2023 15:41:26 -0400
From: Jeffrey Walton <noloader@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Perl's HTTP::Tiny has insecure TLS cert default,
affecting CPAN.pm and other modules
On Wed, May 3, 2023 at 3:21 PM Reid Sutherland <reid@...rddimension.net> wrote:
> On 4/29/23 06:04, Stig Palmquist wrote:
> >
> > - CVE-2023-31484 for CPAN.pm
> > - CVE-2023-31485 for GitLab::API::v4
> > - CVE-2023-31486 for HTTP::Tiny
> > ...
>
> Who actually decides when something receives a CVE? This can be used to
> defame projects and products as in this case.
"Who decides" can be a tricky question.
Several organizations issue CVEs, like Red Hat and Gentoo. A bug
usually has to meet a criteria, like falling into a CWE category, to
be issued by the organization.
You can also get them from Mitre's site. In the case of Mitre, it is
the person who requests the CVE.
Some CVE's are tenuous or questionable. You often see this from folks
trying to pad their resume. For example, a researcher may request a
CVE for a behavior that requires elevated privileges. In this case,
someone who is Root on Linux or Administrator on Windows can already
do the damage, so the behavior in question that happens with
privileges is not really interesting.
In the case of HTTP::Tiny, the default configuration and behavior is
running afoul of https://cwe.mitre.org/data/definitions/295.html and
https://cwe.mitre.org/data/definitions/319.html. In this case, the
industry believes comms should use HTTPS and the name hostname should
be validated.
Jeff
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
