[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <53ABCF86.7030607@redhat.com>
Date: Thu, 26 Jun 2014 17:45:10 +1000
From: Murray McAllister <mmcallis@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: Re: Question regarding CVE applicability of missing
HttpOnly flag
On 06/26/2014 05:38 PM, Henri Salo wrote:
> On Thu, Jun 26, 2014 at 05:30:46PM +1000, Murray McAllister wrote:
>> But websites set lots of cookies, which if stolen, have no relevance
>> to being able to access the user's session, or do much of anything
>> useful with anyway. I believe a lot of the "this cookie does not
>> have HTTPOnly" issues are non-issues.
>
> Those CVEs should be REJECTED. Can you provide list of non-issues with CVE?
>
> ---
> Henri Salo
>
I was not clear, sorry. I had not looked at the original CVEs, and was
just talking in general: Red Hat has
https://access.redhat.com/site/articles/66234 and we get a lot of
httponly related reports (assuming others get them too).
Cheers,
--
Murray McAllister / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
