[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20141007203500.EC183C50B42@smtptsrv1.mitre.org>
Date: Tue, 7 Oct 2014 16:35:00 -0400 (EDT)
From: cve-assign@...re.org
To: kseifried@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: Discussion: information leakage from server and client software - CVE/hardening/other?
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
The main cases in which a CVE could exist are:
1. The author of the software states that the information-leakage
behavior was a violation of the product's security policy.
2. The information-leakage behavior directly contradicts the product's
documentation stating that the specific information leakage doesn't
occur.
3. The author of the software makes no statement, but all (or nearly
all) similar products follow a standard practice in which the
information-leakage behavior doesn't occur. For example: common web
browsers don't send a file: URL in a Referer header.
4. The author of the software makes no statement, and disclosing the
information results in no benefit to the user, and the information
would not be useful to the vendor in further developing the product or
complying with restrictions on the data that the vendor offers in
conjunction with the product.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJUNE1sAAoJEKllVAevmvmsfGwIAK3AZYGPKsOQhdaAorKi8Bly
SFuaSXCjmhkswmH74fN11UCmU4OWwV+3Vv66iE/YGpZDk4j1yFJR3fYLTeTcYCuH
xTPyAbsBI4UcrcNtay9iujUgcXe7lRxc8b8E2l962dEm3Xw1FzzFUUtC+kVUCoyR
4qHWsS+1eUIZ7+q6L5ITG12K4hvYHwGRDzr08+IvESfmvskgc3tCEgV/eHa009Rs
rM/M6o9EE0CEyDCyhFk4LiZgSq8UjG5lJCMP4aeA8t43eSNGeWSSXnaZIwOiPwsC
UNl4GDN3Ro1+WPumX6fiJmXVq/h5B7S5oCBjPyjUOsz2ZI9Kce+T9Dug3l/PtU0=
=wGXw
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
