oss-sec mailing list archives
Re: Re: MySQL - use-after-free after mysql_stmt_close()
From: Kurt Seifried <kseifried () redhat com>
Date: Thu, 15 Jun 2017 08:21:29 -0600
This does bring up an old question: Should we assign CVEs for code examples/documentation? E.g. We assign CVEs for code shipped to people in digital form. Why not assign CVEs for code in documentation or commonly used examples? We can go with the rational that CVEs get assigned to the affected code bases (e.g. when someone implements that documentation/code), but it might also be good to educate the community about bad examples/documentation/etc. My thinking is: 1) Official documentation that says "do this [insecure thing]" should probably get a CVE (e.g. "turn off all the encryption to make it work more easily"). This should probably get a CVE, especially as it results in operational changes which won't get a CVE (since it's not in code that "ships", it's just on the end of whoever is using it). 2) Official code examples, as above, actual implementations get CVEs, it might be useful to raise awareness that the example is bad. 3) Unofficial but commonly used documentation and code examples, I guess the best example here is stackoverflow and friends? Thoughts/comments (feel free to reply privately if you don't want to be public)? I'd like to collect what people think and then present it to the CVE board later (this has been on my long term todo list). On Thu, Jun 15, 2017 at 7:50 AM, Adam Maris <amaris () redhat com> wrote:
On Mon, 2017-06-12 at 23:47 +0200, Pali Rohár wrote:Hello! Any idea how to handle this particular problem?Hi! Given that Oracle (silently) updated the vulnerable example in their documentation, this likely indicates the way to handle this - applications that copied the vulnerable example needs to be fixed and CVEs will be assigned per application. Best Regards, -- Adam Mariš, Red Hat Product Security 1CCD 3446 0529 81E3 86AF 2D4C 4869 76E7 BEF0 6BC2
-- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Red Hat Product Security contact: secalert () redhat com
Current thread:
- MySQL - use-after-free after mysql_stmt_close() Pali Rohár (Jun 08)
- Re: MySQL - use-after-free after mysql_stmt_close() Pali Rohár (Jun 12)
- Re: Re: MySQL - use-after-free after mysql_stmt_close() Adam Maris (Jun 15)
- Re: Re: MySQL - use-after-free after mysql_stmt_close() Kurt Seifried (Jun 15)
- Re: Re: MySQL - use-after-free after mysql_stmt_close() Kurt H Maier (Jun 15)
- Re: Re: MySQL - use-after-free after mysql_stmt_close() kseifried () redhat com (Jun 15)
- Re: Re: MySQL - use-after-free after mysql_stmt_close() Seth Arnold (Jun 15)
- Re: Re: MySQL - use-after-free after mysql_stmt_close() Adam Maris (Jun 15)
- Re: Re: MySQL - use-after-free after mysql_stmt_close() Feng Cao (Jun 15)
- Re: Re: MySQL - use-after-free after mysql_stmt_close() Brian May (Jun 15)
- Re: MySQL - use-after-free after mysql_stmt_close() Pali Rohár (Jun 12)