Re: Fwd: temporary file creation vulnerability in Redis

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> I can understand and accept this view even though I might see it a
> differently.

We recognize that there's a significant number of issues that fall
into the general category of "it could be useful to draw attention to
this aspect of a security model, because the documentation is arguably
inconsistent or obscure, and this may result in risks to end users."
Currently, the scope of CVE identifiers doesn't really extend to these
types of "useful to draw attention" identifiers.

What we can do is assign a CVE ID if any vendor bundles a copy of
Redis with a default directory of /tmp, and decides to make a security
announcement about that. We feel there's a distinction between
"there's nothing stopping an end user from choosing a world-writable
dataset directory" and "it ships world-writable."

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTC0+NAAoJEKllVAevmvmsMqwH/j7Kwt5y6kN92u2JFeb/irRH
NLXMhSMS+tLwrFlOdHDT+6P/pz7MqR+3qH5aSQoV38F92UvMD5VsSjYufczFJjBv
8uerZbJRZ3pE+07zgAoqI0DmWGqbCEHRDjCwuWiOh7Mc1Ww9Uvvz9Ubrze5QKB2t
6TlAMWuWkfqAlJDCjXjhN+vXhAyfpjl4HHlIYSJj0VQhC0gr14Ygp0FQWR/e75/h
mzrOi3/9YKJIodN3T9kDk3BoSBBXhXmWxpXIOjGahEAZteWAiPmHZkYTXiJWhSRo
EhTqrItQyJk8AxNXrojhnPQaFe3b04UPH+fs85FLCfRkH6orWTBfYVgYo6qXf30=
=Gvye
-----END PGP SIGNATURE-----