[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <201401021945.s02Jj5eM028477@linus.mitre.org>
Date: Thu, 2 Jan 2014 14:45:05 -0500 (EST)
From: cve-assign@...re.org
To: dkg@...thhorseman.net
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, fweimer@...hat.com
Subject: Re: kwallet crypto misuse
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Thanks very much for this additional information. At this point, it
seems very unlikely that the "\0a\0b\0c\0d" issue will have an
additional CVE assignment. We were asking just because of the
possibility of a clear implementation error in which security was
weakened by using a "wrong" character width.
> Do you think MITRE or other folks should be recommending pre-whitening
> the strings before encrypting them
It's possible that a group elsewhere at MITRE would work on
recommendations in that area or other areas. For purposes of the CVE
assignments in this situation, that type of opportunity for security
improvement wasn't being considered.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJSxcEIAAoJEKllVAevmvmsyJoH/R/Z4u6+P/T7Hk3Mj0h1nidp
cmG3PUnqQFSzYwWoo3NIst8KTpt1MZQmbAtfTkY3w2hEpqwbQk18pNLzY+lcUFIr
wamgvXoyWPOYNcp7NypQfHoRQOT9TdFjhIxJXy9R1VLqfyeubs19uN+iYILDS+ik
BgdStB2F1geISFG6M+hO+WtFouk61b5ZaC5ejEjkkEs7U6LQnRcF4WxNmZ3ym2ml
zO/kSfpUpzgjMurtRbBFhuh13L2Ohl0nxiizsUv735JH5aL+TX7V8d1B/+11ZXTs
RP85J3qyCRYswi0oaCLhOx4Qv/YcUZlCJZIHyTb7seJvJShV6xclQunJD3GFZDU=
=YscU
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
