[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140331094212.GD6862@suse.de>
Date: Mon, 31 Mar 2014 11:42:12 +0200
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVEs, Crypto and "vulnerabilities"
On Mon, Mar 31, 2014 at 08:31:18PM +1100, Michael Samuel wrote:
> On 31 March 2014 17:26, Kurt Seifried <kseifried@...hat.com> wrote:
> > So the line in the sand is moving currently, I think this issue is
> > another good example of something that may qualify for a CVE, or maybe
> > not, depends where we draw the line.
> >
> > https://github.com/opencart/opencart/issues/1279
> >
> > So if someone has strong opinions either way please speak up.
>
> This looks like an easily exploitable bug. What possible reason could there
> be for it not qualifying?
>
> If somebody wrote an exploit would it be disqualified just because the author
> doesn't understand?
I understand CVE guidance as "security issue in CVE sense, when
assumptions for code are not met by the implementation"
It is not clear what the assumption is here, what should be the result of the encryption
and where should it be stored?
Is it mostly obfuscation? Or secure storage of content?
Ciao, Marcus
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
