oss-sec mailing list archives
Re: Discussion: information leakage from server and client software - CVE/hardening/other?
From: cve-assign () mitre org
Date: Tue, 7 Oct 2014 16:35:00 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 The main cases in which a CVE could exist are: 1. The author of the software states that the information-leakage behavior was a violation of the product's security policy. 2. The information-leakage behavior directly contradicts the product's documentation stating that the specific information leakage doesn't occur. 3. The author of the software makes no statement, but all (or nearly all) similar products follow a standard practice in which the information-leakage behavior doesn't occur. For example: common web browsers don't send a file: URL in a Referer header. 4. The author of the software makes no statement, and disclosing the information results in no benefit to the user, and the information would not be useful to the vendor in further developing the product or complying with restrictions on the data that the vendor offers in conjunction with the product. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJUNE1sAAoJEKllVAevmvmsfGwIAK3AZYGPKsOQhdaAorKi8Bly SFuaSXCjmhkswmH74fN11UCmU4OWwV+3Vv66iE/YGpZDk4j1yFJR3fYLTeTcYCuH xTPyAbsBI4UcrcNtay9iujUgcXe7lRxc8b8E2l962dEm3Xw1FzzFUUtC+kVUCoyR 4qHWsS+1eUIZ7+q6L5ITG12K4hvYHwGRDzr08+IvESfmvskgc3tCEgV/eHa009Rs rM/M6o9EE0CEyDCyhFk4LiZgSq8UjG5lJCMP4aeA8t43eSNGeWSSXnaZIwOiPwsC UNl4GDN3Ro1+WPumX6fiJmXVq/h5B7S5oCBjPyjUOsz2ZI9Kce+T9Dug3l/PtU0= =wGXw -----END PGP SIGNATURE-----
Current thread:
- Discussion: information leakage from server and client software - CVE/hardening/other? Kurt Seifried (Oct 07)
- Re: Discussion: information leakage from server and client software - CVE/hardening/other? cve-assign (Oct 07)
- Re: Discussion: information leakage from server and client software - CVE/hardening/other? cve-assign (Oct 07)
- Re: Discussion: information leakage from server and client software - CVE/hardening/other? cve-assign (Oct 07)