Re: Thoughts on a vuln/CVE?

[Florian Weimer <fweimer () redhat com>]

On 06/18/2013 08:44 AM, Kurt Seifried wrote:
> However my original question still stands, can/should we consider a
> common configuration of software that goes from being secure to
> insecure to be worthy of a CVE? A lot of things that used to be common
> practice (like shipping every service/server enabled, all accounts
> active, all access enabled, anonymous uploads allowed, etc.) are now
> seen as security vulnerabilities/exposures.

We definitely do.  A recent example is CVE-2012-4446.

--
Florian Weimer / Red Hat Product Security Team