oss-sec mailing list archives
Re: CVE request: epiphany not checking ssl certs
From: Josh Bressers <bressers () redhat com>
Date: Tue, 21 Sep 2010 10:55:17 -0400 (EDT)
Please use CVE-2010-3312 for this. Thanks. -- JB ----- "Michael Gilbert" <michael.s.gilbert () gmail com> wrote:
On Fri, 17 Sep 2010 14:45:28 -0400 (EDT), Steven M. Christey wrote:If an application does not advertise a security feature, then ingeneralwe will not give a CVE because of its absence of the feature (Idon't wantto give out 50,000 CVEs for every protocol that does cleartext transmission... or uses DES... etc.) Similarly, we generally avoidassigning CVEs to "defense in depth" fixes, although the linebetween"vulnerability" and "defense in depth" can get fuzzy. The http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=564690#5 titlesays"Does not longer check certificates" which could be interpreted tomeanthat it used to check certs, and now it doesn't. If that's thecase, thenit makes sense to assign a CVE.The feature was lost in the transition from gecko to webkit (or more accurately libsoup for certificate support). I think it makes sense to assign an id since it does involve the loss of an expected security feature. Mike
Current thread:
- CVE request: epiphany not checking ssl certs Hanno Böck (Sep 17)
- Re: CVE request: epiphany not checking ssl certs Tomas Hoger (Sep 17)
- Re: CVE request: epiphany not checking ssl certs Josh Bressers (Sep 17)
- Re: CVE request: epiphany not checking ssl certs Steven M. Christey (Sep 17)
- Re: CVE request: epiphany not checking ssl certs Michael Gilbert (Sep 17)
- Re: CVE request: epiphany not checking ssl certs Josh Bressers (Sep 21)
- Re: CVE request: epiphany not checking ssl certs Ludwig Nussel (Sep 20)
- Re: CVE request: epiphany not checking ssl certs Tomas Hoger (Sep 17)