[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0905211809370.18536@faron.mitre.org>
Date: Thu, 21 May 2009 18:13:12 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request -- kdebase4 (konqueror) -- Incomplete
SSL Certificate support in KDE4
In CVE, we treat the inadvertent prevention of access to security
functionality as a bug. There is no direct way that an external attacker
can trigger it, and the attacker gets no direct benefit by waiting for it
to happen passively. It's only doable by a person doing this to
himself/herself.
So, this would not get a CVE.
- Steve
On Tue, 12 May 2009, Jan Lieskovsky wrote:
> Hello Steve,
>
> not sure if original Debian bug [1] reporter meant this insufficiency,
> but [2] might be interesting for your attention. While this is not
> direct security vulnerability, is is preventing users from using
> the functionality provided by digital certificates.
>
> References:
> [1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=526979
> [2] https://bugs.kde.org/show_bug.cgi?id=185288
> [3] https://bugzilla.redhat.com/show_bug.cgi?id=500373
>
> This issue is present only in Konqueror web browser, as shipped
> with the K Desktop Environment 4 (kdebase-4.*). Konqueror in
> kdebase3 works fine.
>
> Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
>
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
