Re: CVE for Kali Linux

[Kurt Seifried <kseifried () redhat com>]

On 03/22/2015 09:54 AM, Jeremy Stanley wrote:
> On 2015-03-22 09:49:12 -0600 (-0600), Kurt Seifried wrote:
> [...]
> > downloads of updates via HTTP with no other protection == CVE
>
> And in this case the updates are signed by a key trusted by a
> keyring baked into the OS, so given the presence of "other
> protection" sounds like no CVE needed?

Right but my original question is if a vendor explicitly tells people
not to check them ("download over http and check sums published over
http") is that CVE worthy? I can see both sides of the argument.


-- 
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Attachment: signature.asc
Description: OpenPGP digital signature