Re: CVE for crypto_get_random() from libsrtp

[Adam Maris <amaris () redhat com>]

On 11/08/15 13:48, Jeremy Stanley wrote:
> On 2015-08-11 09:51:50 +0200 (+0200), Adam Maris wrote:
> [...]
> > Unless CVE is assigned, we don't plan to ship any patch at the moment.
> I find this an interesting stance. Don't you decide on your own
> whether your customers are impacted by a bug sufficiently to require
> a fix (security vulnerability or otherwise)? It seems reasonable to
> me that you would choose whether or not to ship a patch
> independently of how MITRE chooses to classify (or not) the
> associated bug... and vice versa, if a CVE is assigned for a bug you
> consider to have minimal impact, do you release a patch for it
> anyway just because there's a CVE?
This has nothing to do with us not fixing flaws just because they don't 
get a CVE. I assure you that we've fixed security flaws that had no CVEs 
before. And if you look through our CVE database, you'll find many 
examples of simple crashers that unfortunately got a CVE, which we did 
not fix.
The main reason for not fixing it for now is that we think 80 bits of 
randomness is enough for most applications up to this day, especially if 
it's session data and not permanent storage, etc. Therefore we classify 
this issue as having a Low security impact. If a CVE is assigned for 
this issue, we will create an entry in our CVE database but the end 
result will likely be the same, wontfix.

--
Adam Maris / Red Hat Product Security