[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <ZFfp47ICc31AgRmN@gentoo.org>
Date: Sun, 7 May 2023 11:11:47 -0700
From: John Helmert III <ajak@...too.org>
To: oss-security@...ts.openwall.com
Subject: Re: Perl's HTTP::Tiny has insecure TLS cert default,
affecting CPAN.pm and other modules
On Wed, May 03, 2023 at 03:41:26PM -0400, Jeffrey Walton wrote:
> On Wed, May 3, 2023 at 3:21 PM Reid Sutherland <reid@...rddimension.net> wrote:
> > On 4/29/23 06:04, Stig Palmquist wrote:
> > >
> > > - CVE-2023-31484 for CPAN.pm
> > > - CVE-2023-31485 for GitLab::API::v4
> > > - CVE-2023-31486 for HTTP::Tiny
> > > ...
> >
> > Who actually decides when something receives a CVE? This can be used to
> > defame projects and products as in this case.
>
> "Who decides" can be a tricky question.
>
> Several organizations issue CVEs, like Red Hat and Gentoo. A bug
> usually has to meet a criteria, like falling into a CWE category, to
> be issued by the organization.
Actually, Gentoo is NOT a CNA, and thus cannot issue CVEs.
> You can also get them from Mitre's site. In the case of Mitre, it is
> the person who requests the CVE.
>
> Some CVE's are tenuous or questionable. You often see this from folks
> trying to pad their resume. For example, a researcher may request a
> CVE for a behavior that requires elevated privileges. In this case,
> someone who is Root on Linux or Administrator on Windows can already
> do the damage, so the behavior in question that happens with
> privileges is not really interesting.
>
> In the case of HTTP::Tiny, the default configuration and behavior is
> running afoul of https://cwe.mitre.org/data/definitions/295.html and
> https://cwe.mitre.org/data/definitions/319.html. In this case, the
> industry believes comms should use HTTPS and the name hostname should
> be validated.
>
> Jeff
Download attachment "signature.asc" of type "application/pgp-signature" (229 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
