[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130205165539.GQ3443@redhat.com>
Date: Tue, 5 Feb 2013 09:55:39 -0700
From: Vincent Danen <vdanen@...hat.com>
To: oss-security@...ts.openwall.com
Cc: nadhem.alfardan.2009@...l.ac.uk, kenny.paterson@...l.ac.uk,
cve-assign@...re.org
Subject: Re: CVE request: TLS CBC padding timing flaw in
various SSL / TLS implementations
* [2013-02-05 16:54:54 +0100] Marcus Meissner wrote:
>On Tue, Feb 05, 2013 at 10:34:23AM +0100, Matthias Weckbecker wrote:
>> Hi,
>>
>> has there already been a CVE assigned for the recent "lucky 13" timing
>> flaw that affects various SSL / TLS implementations (including GnuTLS)?
>>
>> http://www.isg.rhul.ac.uk/tls/
>> http://www.gnutls.org/security.html#GNUTLS-SA-2013-1
>>
>> I think this could qualify for CVE for each open source implementation
>> that's prone.
>
>openssl has released updated packages with a CVE assigned, unclear
>whether it covers just openssl or also the others.
>
>http://www.openssl.org/news/secadv_20130205.txt
cc'ing cve-assign to see if they can provide some guidance here. I also
noticed that OpenSSL has a CVE for this (I'm assuming that the
CVE-2012-2686 issue is _not_ the same thing, but that CVE-2013-0169 is
this issue).
Since it's a weakness in TLS/DTLS itself, from my understanding, and not
necessarily in a particular implementation, I'm not sure if this
qualifies as one CVE for the weakness, or if it needs one per
implementation.
MITRE, can someone provide some guidance on this?
--
Vincent Danen / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
