Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 08 Oct 2014 10:32:12 -0600
From: Kurt Seifried <>
Subject: Re: CVE request  for VDSM denial of service

On 08/10/14 03:34 AM, Sven Kieske wrote:
> On 08/10/14 09:34, Wade Mealing wrote:
>> Gday,
>> The issue (outlined here ) allows
>> an attacker to hold open an ssl connection effectively denying new connections the
>> ability to complete any new ssl connections.
>> I would like a CVE number to assign to this issue.  Please assign me one.
> Doesn't RH assign it's own CVEs anymore?

We do, but for public issues we prefer to ask here sometimes so as to
prevent duplicate assignments (e.g. it is possible for a race condition
to occur, Red Hat and Mitre both see something new, we see no CVE for it
so we both assign one).

I believe this one is
(but don't quote me, wmealing is in .au and asleep so I can't confirm).

> I also wonder why this bug wasn't reported to upstream
> (wrong BZ "Product" at least it should get cloned to ovirt).

Because we learned about it from an upstream source.

Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.