Re: CVE's for SSLv2 support

[Kurt Seifried <kseifried () redhat com>]

Ok let me simplify:

If a crypto library (e.g. OpenSSL, NSS) supports AND enables SSLv2 by
default should it receive a CVE? Essentially we'd be saying "SSLv2 is so
bad, that supporting/enabling it by default in a crypto library is CVE
worthy" (essentially under the CVE assignment for "product makes a security
claim that it fails to do properly").

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert () redhat com