[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <8761xc54b4.fsf@windlord.stanford.edu>
Date: Mon, 17 Jun 2013 23:19:27 -0700
From: Russ Allbery <rra@...nford.edu>
To: oss-security@...ts.openwall.com
Subject: Re: Thoughts on a vuln/CVE?
Kurt Seifried <kseifried@...hat.com> writes:
> We have software with a now insecure configuration as it points to a
> site that may or may not be under attacker control. It seems to me like
> this might be a candidate for a CVE. Thoughts and comments for and
> against are welcome (I'm on the fence myself).
It's possibly worth noting that the repository that was at that site was
signed and had been for some years, and the key was not compromised. So
not only would the site need to be taken over by an attacker for a
successful exploit, but the affected user would have to ignore the copius
warnings that APT produces when installing packages from an untrusted
archive, or have configured APT to not check repository signatures.
--
Russ Allbery (rra@...nford.edu) <http://www.eyrie.org/~eagle/>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
