[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <55C9F162.8030700@redhat.com>
Date: Tue, 11 Aug 2015 14:58:10 +0200
From: Adam Maris <amaris@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE for crypto_get_random() from libsrtp
On 11/08/15 13:48, Jeremy Stanley wrote:
> On 2015-08-11 09:51:50 +0200 (+0200), Adam Maris wrote:
> [...]
>> Unless CVE is assigned, we don't plan to ship any patch at the moment.
> I find this an interesting stance. Don't you decide on your own
> whether your customers are impacted by a bug sufficiently to require
> a fix (security vulnerability or otherwise)? It seems reasonable to
> me that you would choose whether or not to ship a patch
> independently of how MITRE chooses to classify (or not) the
> associated bug... and vice versa, if a CVE is assigned for a bug you
> consider to have minimal impact, do you release a patch for it
> anyway just because there's a CVE?
This has nothing to do with us not fixing flaws just because they don't
get a CVE. I assure you that we've fixed security flaws that had no CVEs
before. And if you look through our CVE database, you'll find many
examples of simple crashers that unfortunately got a CVE, which we did
not fix.
The main reason for not fixing it for now is that we think 80 bits of
randomness is enough for most applications up to this day, especially if
it's session data and not permanent storage, etc. Therefore we classify
this issue as having a Low security impact. If a CVE is assigned for
this issue, we will create an entry in our CVE database but the end
result will likely be the same, wontfix.
--
Adam Maris / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
