oss-security - Re: CVE request: epiphany not checking ssl certs

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <112978625.203461285080917580.JavaMail.root@zmail01.collab.prod.int.phx2.redhat.com>
Date: Tue, 21 Sep 2010 10:55:17 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: epiphany not checking ssl certs

Please use CVE-2010-3312 for this.

Thanks.

-- 
    JB


----- "Michael Gilbert" <michael.s.gilbert@...il.com> wrote:

> On Fri, 17 Sep 2010 14:45:28 -0400 (EDT), Steven M. Christey wrote:
> > 
> > If an application does not advertise a security feature, then in
> general 
> > we will not give a CVE because of its absence of the feature (I
> don't want 
> > to give out 50,000 CVEs for every protocol that does cleartext 
> > transmission... or uses DES... etc.)  Similarly, we generally avoid
> 
> > assigning CVEs to "defense in depth" fixes, although the line
> between 
> > "vulnerability" and "defense in depth" can get fuzzy.
> > 
> > The http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=564690#5 title
> says 
> > "Does not longer check certificates" which could be interpreted to
> mean 
> > that it used to check certs, and now it doesn't.  If that's the
> case, then 
> > it makes sense to assign a CVE.
> 
> The feature was lost in the transition from gecko to webkit (or more
> accurately libsoup for certificate support). I think it makes sense
> to
> assign an id since it does involve the loss of an expected security
> feature.
> 
> Mike

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.