[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <538FE794.4080307@redhat.com>
Date: Wed, 04 Jun 2014 21:44:20 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: cve-assign@...re.org
Subject: Re: Re: CVE-2014-0234 Installer: OpenShift Enterprise:
openshift.sh default password creation
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 06/03/2014 12:35 PM, cve-assign@...re.org wrote:
> Are there any additional thoughts about CVE-2014-0234 before we
> cover it on the cve.mitre.org web site? See:
>
> http://openwall.com/lists/oss-security/2014/05/29/4
>
> We had planned to proceed with this viewpoint:
>
> 1. If Red Hat shipped Red Hat OpenShift Enterprise 2 with a
> publicly known password in broker.conf, Red Hat is allowed to
> categorize that as a vulnerability and assign a CVE ID.
This would depend on how you installed it, e.g. as an upgrade?a new
install? If new then manually? from the script? In this case it was
that specific install script which was also documented as a possible
install method, thus I felt it deserved a CVE.
> 2. There was also an issue in an example script. The script in
> question had comments of "not comprehensive nor robust enough ...
> require significant adaptations ... Please adapt it." Nonetheless,
> this is a script authored by Red Hat, and Red Hat might have been
> treating it as a supported part of a software product. If so, then
> Red Hat is allowed to categorize a script issue as a vulnerability
> and assign a CVE ID. Unless Red Hat chooses to take that position,
> the default decision for that type of disclaimed example code is
> that a CVE ID assignment isn't made.
Correct, however in this case we document it as an install method, so
I felt it deserved a CVE, had it not been documented/mentioned I would
have not assigned a CVE at all since it would have been "example code"
for lack of a better term.
> 3. The CVE IDs in 1 and 2 can't be the same.
?
- --
Kurt Seifried - Red Hat - Product Security - Cloud stuff and such
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIcBAEBAgAGBQJTj+eUAAoJEBYNRVNeJnmToVYP/0CXLxTfu+eLfI2b4vmihx9B
caK4FOaLX9Wvu5hBFubn0XvI5kNHnCbXaADvA7F/ANihkOjipglnkgPfOlUANMx7
qSBuDGoimjdIa6bbkVTlTZJybBN3B5tDVOzZvnfMMIrlER1t+7JuKTluyRzjPqgB
okkY/L3KtTg9hmna9xUMQjCqDU/R+B3qr0jLVj1N8bUCD+mW3TtQag7GrERKOTcN
97M+QOt/4AbQehbQldt8s3CuF5P53S31bR7d76fe5twfynicqH3nrBnNQvZ5ZcR4
d5mxpknZkf2LyTSMq99S5Hh/sNKko4ZqEXUh/g3ha73TmCTYFfZTGPWp4Pp9TRGa
eDXn5j+qMarwOi1MnnxKtW3ekGCSxBg18S6ULoWljedenm/R83zFCysBDtkb1QA/
BGPM0RepMcR2qGQrXQqR9louk0HBvGd0QcpZYdgeLYj3jcuWjgpLzu+iLjxSxCrz
hA7q8BbVKGmIP0z2oSJxZCFwefTiWnkEZIhkfb0DmFbb5+W2Ydtu4o6EdiYkEs5j
loOt9chquCrr1QAGW4r29fKGfi0Ttqun46silQldS1PKdVk0sg4/bwJt64mDNLWf
mNjaVD1lNIIMJOQ286397NoZv0GVVuvX7i3A22C23UUZH7eUqeaXXeomoBM4GNU7
yDDtJkq6+YTrqF44cLoH
=/kfN
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
