oss-security - Current CVE policy on missing-hardening bugs

Message-ID: <87v9vb973d.fsf@oldenburg2.str.redhat.com>
Date: Mon, 05 Aug 2019 13:36:54 +0200
From: Florian Weimer <fweimer@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Current CVE policy on missing-hardening bugs

What's the current policy on assinging CVE IDs for bugs that are merely
missed hardening opportunities?  One example is lack of full ASLR due to
address space limits (47 or fewer bits instead of the theoretical limit
of 64 bits).

Are they eligible for CVE assignment?  Should we DISPUTE them if we
encounter them?

Thanks,
Florian

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.