Re: CVE for Kali Linux

[Solar Designer <solar () openwall com>]

On Sun, Mar 22, 2015 at 10:09:51PM -0600, Kurt Seifried wrote:
> My understanding was for software that downloads updates or other
> executable components over HTTP instead of HTTPS, AND there is no other
> protection (e.g. signed RPMs), so in effect there is nothing to protect
> it, then it gets a CVE since the user is essentially up the creek at
> that point.

If CVE goes this far, then I recommend that we don't include http vs.
https into this equation.  Simply require signatures.  "No signature for
software?  Here's your CVE."  This simple.

A problem here is that these are operations and not software issues, so
assigning CVEs for them would be inconsistent with and useless for the
usual purpose of CVEs (tracking of fixes in distros and deployments),
and with CVEs being assigned to specific software versions (a signature
will generally be added without releasing a new version).

I think these issues should be tracked separately, not via CVE.  I agree
that tracking lack of software signatures, and encouraging change, is a
good idea.

Alexander