oss-sec mailing list archives

Re: Re: CVE's for SSLv2 support

From: Tim <tim-security () sentinelchicken org>
Date: Tue, 1 Mar 2016 11:31:44 -0800

For example, there might be a crypto library intended for
communication on isolated networks to high-value embedded devices that
support only SSLv2, and cannot and will not ever be updated.


Just because there is no easy fix for a vulnerability, does that mean
it isn't a vulnerability?

tim

Current thread:

CVE's for SSLv2 support Kurt Seifried (Mar 01)
- Re: CVE's for SSLv2 support Loganaden Velvindron (Mar 01)
  - Re: CVE's for SSLv2 support Grant Ridder (Mar 01)
  - Re: CVE's for SSLv2 support Stuart Henderson (Mar 01)
- Re: CVE's for SSLv2 support gremlin (Mar 01)
- Re: CVE's for SSLv2 support cve-assign (Mar 01)
  - Re: CVE's for SSLv2 support Kurt Seifried (Mar 01)
    - Re: CVE's for SSLv2 support cve-assign (Mar 01)
    - Re: CVE's for SSLv2 support Kurt Seifried (Mar 01)
    - Re: CVE's for SSLv2 support cve-assign (Mar 01)
    - Re: Re: CVE's for SSLv2 support Tim (Mar 01)
    - Re: Re: CVE's for SSLv2 support Bob Beck (Mar 01)
    - Re: Re: CVE's for SSLv2 support Kurt Seifried (Mar 01)
    - Re: Re: CVE's for SSLv2 support Bob Beck (Mar 01)
    - Re: Re: CVE's for SSLv2 support Kurt Seifried (Mar 01)
    - Re: Re: CVE's for SSLv2 support Steve Grubb (Mar 02)
  - Re: Re: CVE's for SSLv2 support Seth Arnold (Mar 01)