[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130205155453.GK2740@suse.de>
Date: Tue, 5 Feb 2013 16:54:54 +0100
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Cc: nadhem.alfardan.2009@...l.ac.uk, kenny.paterson@...l.ac.uk
Subject: Re: CVE request: TLS CBC padding timing flaw in
various SSL / TLS implementations
On Tue, Feb 05, 2013 at 10:34:23AM +0100, Matthias Weckbecker wrote:
> Hi,
>
> has there already been a CVE assigned for the recent "lucky 13" timing
> flaw that affects various SSL / TLS implementations (including GnuTLS)?
>
> http://www.isg.rhul.ac.uk/tls/
> http://www.gnutls.org/security.html#GNUTLS-SA-2013-1
>
> I think this could qualify for CVE for each open source implementation
> that's prone.
openssl has released updated packages with a CVE assigned, unclear
whether it covers just openssl or also the others.
http://www.openssl.org/news/secadv_20130205.txt
Ciao, Marcus
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
