[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <201403111142.s2BBfxv1004802@linus.mitre.org>
Date: Tue, 11 Mar 2014 07:41:59 -0400 (EDT)
From: cve-assign@...re.org
To: hanno@...eck.de
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: When is broken crypto a vulnerability?
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
>> It's not completely clear what you mean. If it were a logic error in
>> the code, e.g., menu choice 2 of "AES encryption" is selected but the
>> code calls the function intended for menu choice 1 of "standard
>> encryption," then a CVE could be assigned to the specific codebase
>> that has that logic error.
> Yes, that's exactly what I meant.
> One product, it's already disclosed to the vendor and I will publish
> details shortly. So we agree this one gets a CVE.
This logic error issue was assigned CVE-2014-2319.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJTHvSnAAoJEKllVAevmvmsXL8IALjFY7yhR0nyZDyqv7Wpi0DQ
F9ie5JCp4JINw8WDVZys78L7Ssquakc6I1jEOhOkbCSlmFM3DJ4bCRbZgr8Fl+hV
Llu0zDKGK4u5s6Dgx4kBgwQkN/5VKfjTLtNuCNHr1FWPVPYbRnskTQTnbWljYpfC
ovGAx+7ZaSyomyZ701TOSEVocsSPVo/Oppfb6P7InsurGQx+V8ZQI0xO89fuffZ/
NdnaBnGicj/i7XAh9ibGE++JDN2wvXmwHraK2z1plKx+eEfFt6174yu4DkcsYcHR
4tztg+5lNsVr7d9BK5y8fCYI777M+ajShDZnkqMAxoPgaOgoExZS/YQVOusfReg=
=SgGd
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
