oss-sec mailing list archives
Re: CVE for Kali Linux
From: Solar Designer <solar () openwall com>
Date: Mon, 23 Mar 2015 07:20:06 +0300
On Sun, Mar 22, 2015 at 10:09:51PM -0600, Kurt Seifried wrote:
My understanding was for software that downloads updates or other executable components over HTTP instead of HTTPS, AND there is no other protection (e.g. signed RPMs), so in effect there is nothing to protect it, then it gets a CVE since the user is essentially up the creek at that point.
If CVE goes this far, then I recommend that we don't include http vs. https into this equation. Simply require signatures. "No signature for software? Here's your CVE." This simple. A problem here is that these are operations and not software issues, so assigning CVEs for them would be inconsistent with and useless for the usual purpose of CVEs (tracking of fixes in distros and deployments), and with CVEs being assigned to specific software versions (a signature will generally be added without releasing a new version). I think these issues should be tracked separately, not via CVE. I agree that tracking lack of software signatures, and encouraging change, is a good idea. Alexander
Current thread:
- Re: CVE for Kali Linux, (continued)
- Re: CVE for Kali Linux Alexander Cherepanov (Mar 23)
- Re: CVE for Kali Linux Alexander Cherepanov (Mar 23)
- Re: CVE for Kali Linux Marcus Meissner (Mar 23)
- Re: CVE for Kali Linux Alexander Cherepanov (Mar 23)
- Re: CVE for Kali Linux Marcus Meissner (Mar 23)
- Re: CVE for Kali Linux Marcus Meissner (Mar 24)
- Re: CVE for Kali Linux Alexander Cherepanov (Mar 24)
- Re: CVE for Kali Linux Kurt Seifried (Mar 22)
- Re: CVE for Kali Linux Solar Designer (Mar 22)