oss-security - Re: CVE Request -- Mercurial --Doesn't verify subject Common Name properly

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1289923322.2983.8.camel@mdlinux>
Date: Tue, 16 Nov 2010 11:02:02 -0500
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: oss-security@...ts.openwall.com
Cc: Bill Janssen <bill.janssen@...il.com>, Andreas Hasenack
 <ahasenack@...ra.com.br>, Mads Kiilerich <mads@...lerich.com>, "Steven M.
 Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request -- Mercurial --Doesn't verify
 subject Common Name properly

Hi,

On Mon, 2010-11-15 at 16:58 -0500, Steven M. Christey wrote:
> Ouch, this is painful for a number of reasons.
> 
> Maybe Python "should" get the CVE, but the decision to push the issue to 
> application developers means that those developers will each have to 
> provide fixes, and software consumers will have to track these related 
> vulns at the application level.
> 
> (One could make the same argument about fundamental design flaws in 
> standards-based protocols, for which CVE generally assigns a single 
> identifier, but those issues generally feel "different" to me.  Quite 
> logical, I know...)
> 
> Anyway, I think we need to assign separate CVEs for each affected product 
> as an instance of "an implementation not working around security-relevant 
> design limitations of APIs" (which is consistent with the approach that 
> CVE has taken with respect to the DLL hijacking / insecure library loading 
> issues of the past couple months.)

Thanks for the clarification. Here are some more projects that need CVEs
for this issue:

libcloud:
https://issues.apache.org/jira/browse/LIBCLOUD-55
https://bugs.launchpad.net/ubuntu/+source/libcloud/+bug/675217

Checkbox:
https://bugs.launchpad.net/ubuntu/+source/checkbox/+bug/625076

Bazaar:
https://bugs.edge.launchpad.net/bzr/+bug/651161


Thanks,

Marc.


-- 
Marc Deslauriers
Ubuntu Security Engineer     | http://www.ubuntu.com/
Canonical Ltd.               | http://www.canonical.com/

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.