[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1201171700520.16209@faron.mitre.org>
Date: Tue, 17 Jan 2012 17:08:51 -0500 (EST)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: gpw password generator giving short password at
low rate
The rarity of an issue does not affect CVE inclusion.
In this case, the product's security feature is not living up to its
advertised capability (by generating shorter passwords than expected) so,
even if it's not that severe an issue, it's probably still of some
importance to some people.
The availability of the software does not directly affect CVE inclusion;
if it could be available for people to install on their own systems, then
it can be covered by CVE. Obviously this applies to any software that is
available for download from the web, whether open or closed source. (I
say "does not directly affect CVE inclusion" because CVE cannot keep up
with every single product and every single vulnerability due to various
limitations - primarily the raw number of vulns that are released every
year - so, some products with limited "market share" might not make it
into CVE even though they would technically qualify.)
- Steve
On Tue, 17 Jan 2012, Yves-Alexis Perez wrote:
> Hi list,
>
> we were pointed at a bug in gpw (a password generator), which makes it
> generate shorter password than required at a rate of ~20 over 1 million.
> The bug is at http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=651510
> (so already public) and I'm wondering if that deserves a CVE:
>
> * gpw seems unmaintained (upstream and in Debian since around 2006)
> * I'm not sure people even use it
> * people using it interactively will notice the password has the wrong
> size
>
> But as it may be used in a script, then it might still be a real issue.
>
> What do people think?
>
> Regards,
> --
> Yves-Alexis
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
