Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 07 Oct 2014 15:45:54 -0600
From: Kurt Seifried <>
Subject: Re: Re: Discussion: information leakage from server
 and client software - CVE/hardening/other?

On 07/10/14 02:35 PM, wrote:
> The main cases in which a CVE could exist are:
> 1. The author of the software states that the information-leakage
> behavior was a violation of the product's security policy.
> 2. The information-leakage behavior directly contradicts the product's
> documentation stating that the specific information leakage doesn't
> occur.
> 3. The author of the software makes no statement, but all (or nearly
> all) similar products follow a standard practice in which the
> information-leakage behavior doesn't occur. For example: common web
> browsers don't send a file: URL in a Referer header.
> 4. The author of the software makes no statement, and disclosing the
> information results in no benefit to the user, and the information
> would not be useful to the vendor in further developing the product or
> complying with restrictions on the data that the vendor offers in
> conjunction with the product.

So for example the
article would indicate to me that this is CVE worthy under #4 for
example. I also assume that "makes no statement" means the company
actually has to make it easily viewed/available, e.g. not buried in some
huge 60 screen long EULA/TOS, or in some random source code file ("# and
here is where we send information back").

Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.