[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAComcpPtkMh2t-19KoUFydMdJXHAgqiCB1m2HSNd3Rfe2WyXhQ@mail.gmail.com>
Date: Tue, 1 Mar 2016 21:03:57 -0700
From: Bob Beck <beck@...nbsd.org>
To: Kurt Seifried <kseifried@...hat.com>
Cc: oss-security <oss-security@...ts.openwall.com>, CVE ID Requests <cve-assign@...re.org>
Subject: Re: Re: CVE's for SSLv2 support
> 1) the SSL/TLS protocols encrypt the and the data cannot be read by an
> attacker
> 2) the SSL/TLS protocols ensure the data is not altered in transit by an
> attacker without detection
When used correctly.. SSLv2 is not.
>
> Additionally depending on how you configure the servers there are claims
> that you are talking to the correct server/client (e.g. using certificates)
> but that is not germane to this discussion.
>
> SSLv2 is obviously NOT capable of ensuring claim #1 (that data is encrypted
> and cannot be read by an attacker), due to a wide variety of issues, and I
> have no doubt more will be found if people keep looking. Hence my thinking
> is that ANY and ALL use of SSLv2 is CVE worthy, especially when considering
> that many devices/manufacturers are less than transparent about their
> configurations/security issues.
While you certainly won't see me defending SSLv2 (I think we were the
first to delete it outright)
there are many other things that currently fall into that category..
I'm agreeing with your sentiment
but if you are to consider usage of SSLv2 as CVE worthy, then you will
need to do the same for SSH version 1,
among other things. So while I certainly appreciate and even agree
with your sentiment, it seems rather timed
politically based on a decision made by one implementaiton of SSL/TLS
that reflects a decision made by most other
implementations long ago. So far from me to say what CVE's should
and shouldn't be used for and issued for, but
if this is the road we're going down can I please have permission to
use your above quoted paragraph
with s/SSLv2/SSH V1/g to request a CVE for *usage or support* of SSH
version 1? You said it perfectly.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
