oss-sec mailing list archives
Re: CVE request: epiphany not checking ssl certs
From: "Steven M. Christey" <coley () linus mitre org>
Date: Fri, 17 Sep 2010 14:45:28 -0400 (EDT)
If an application does not advertise a security feature, then in general we will not give a CVE because of its absence of the feature (I don't want to give out 50,000 CVEs for every protocol that does cleartext transmission... or uses DES... etc.) Similarly, we generally avoid assigning CVEs to "defense in depth" fixes, although the line between "vulnerability" and "defense in depth" can get fuzzy.
The http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=564690#5 title says "Does not longer check certificates" which could be interpreted to mean that it used to check certs, and now it doesn't. If that's the case, then it makes sense to assign a CVE.
- Steve On Fri, 17 Sep 2010, Tomas Hoger wrote:
On Fri, 17 Sep 2010 14:19:03 +0200 Hanno Böck wrote:http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=564690 http://blog.fefe.de/?ts=b26ca29d Did this get a CVE yet?Any specific reason to only give CVE to epiphany if you want to start giving CVEs for this kind of flaw? IIRC, not long ago, no WebKitGtk-based browser I tried verified server SSL certificates and all connected without any complaint or indication that SSL certificate was not verified. None seemed to offer any configuration option to enable certificate checking. I guess there may be / was some limitations on WebKitGtk side that can explain this. I noticed midori now uses different address bar background color, which seem to be similar to the epiphany fix described in the Debian bug. Oh, now I see you're probably asking for CVE for post-deb#564690 behavior, not pre-deb#564690, right? -- Tomas Hoger / Red Hat Security Response Team
Current thread:
- CVE request: epiphany not checking ssl certs Hanno Böck (Sep 17)
- Re: CVE request: epiphany not checking ssl certs Tomas Hoger (Sep 17)
- Re: CVE request: epiphany not checking ssl certs Josh Bressers (Sep 17)
- Re: CVE request: epiphany not checking ssl certs Steven M. Christey (Sep 17)
- Re: CVE request: epiphany not checking ssl certs Michael Gilbert (Sep 17)
- Re: CVE request: epiphany not checking ssl certs Josh Bressers (Sep 21)
- Re: CVE request: epiphany not checking ssl certs Ludwig Nussel (Sep 20)
- Re: CVE request: epiphany not checking ssl certs Tomas Hoger (Sep 17)