oss-sec mailing list archives
Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations
From: cve-assign () mitre org
Date: Tue, 5 Feb 2013 12:45:48 -0500 (EST)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
cc'ing cve-assign to see if they can provide some guidance here. I also noticed that OpenSSL has a CVE for this (I'm assuming that the CVE-2012-2686 issue is _not_ the same thing, but that CVE-2013-0169 is this issue). Since it's a weakness in TLS/DTLS itself, from my understanding, and not necessarily in a particular implementation, I'm not sure if this qualifies as one CVE for the weakness, or if it needs one per implementation. MITRE, can someone provide some guidance on this?
[ This is mostly directed to Red Hat at this point. We'll expand to the other recipients or vendors later. ] We're not exactly sure that MITRE has the next step here. A CVE exists, CVE-2013-0169, that was issued by the Red Hat CNA. When the CVE assignment was made, presumably one or more persons at Red Hat had a working understanding of what the name CVE-2013-0169 means. (For example: was the CVE assigned with a multi-vendor scope in mind? Was the CVE assigned to cover the entirety of the content of the www.isg.rhul.ac.uk/tls/TLStiming.pdf research paper?) MITRE would, in general, want to preserve this original meaning if it makes sense to do that. Because there's no specific statement on this list about what CVE-2013-0169 means, we'd next go to https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0169 to see if that may be a canonical statement of what CVE-2013-0169 means. But there's nothing there yet. Before offering a guess from MITRE, we'll wait for some more information. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (SunOS) iQEcBAEBAgAGBQJREUKdAAoJEGvefgSNfHMdf7QH/1Pwhz88Getd4QEG5W7aM4Xy Wyu9c+HxX/PdkqmEcJuWXRvfMVPex9Gv8wD6qCGGQLIX6aHp2gLIrqjfOlUrHmoD 5adHOPhJRAGM4UxZPKM7Y7KU8/etoZGQeJsuH1EUNUIzZmG6pJN2l3++j0vpNoN9 12r4pDHvop3LCY1kMz75uarC+7vKD63xu+jvCQWNqVFV/gOmCkknNq9wLfZWTg+L xA1sooDw80Vkdrv6kIhMSCbdtZ/GqAv4R0b7CDyCuRJOqT1Ml0P/JiE0n0DSjR3u 1FsqEw2RtkfzgDKJQbcm4n4miuwh5da9hCMR/aY4jL/bKT5Cy/MlggAb+VJW3mg= =a2X7 -----END PGP SIGNATURE-----
Current thread:
- CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations Matthias Weckbecker (Feb 05)
- Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations Matthias Weckbecker (Feb 05)
- Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations Matthias Weckbecker (Feb 05)
- Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations Marcus Meissner (Feb 05)
- Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations Vincent Danen (Feb 05)
- Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations cve-assign (Feb 05)
- Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations Vincent Danen (Feb 05)
- Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations cve-assign (Feb 05)
- Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations cve-assign (Feb 05)
- Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations Hanno Böck (Feb 07)
- Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations Kurt Seifried (Feb 07)
- Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations cve-assign (Feb 07)
- Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations Vincent Danen (Feb 05)
- Re: CVE request: TLS CBC padding timing flaw in various SSL / TLS implementations Matthias Weckbecker (Feb 05)