[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200808120909.474405c1@computer>
Date: Sat, 8 Aug 2020 12:09:09 +0200
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: Voiding CVE-2020-16248
FWIW while I don't particularly care about the CVE assignment issue, I
think there is a valuable discussion to have here.
I feel the issue here is that with SSRF there often seems to be some
kind of difficulty to pinpoint whether something is actually a flaw or
an intended feature and who's to blame.
Ultimately these issues come down to this:
* There's an expectation that network requests originating from
localhost (or from a tightly controlled internal network IP) can be
considered trustworthy and are performed by someone/something with
some form of local authority.
* However that's not necessarily true as you may have many applications
that do outgoing network requests that in a variety of ways can be
controlled by an attacker.
I feel this is somehow also similar to fights between network security
thinking and endpoint security thinking that we can see elsewhere.
(e.g. the whole TLS interception debate.)
--
Hanno Böck
https://hboeck.de/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
