News for hackers. Stuff that matters.

A comment on CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buffer Overflows.

Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by blueflow on Tuesday November 01, 2022 @12:29PM (#33423493)
> Q: Is this a branded vulnerability?

> A: The OpenSSL project has not named or created logos for either CVE. The best way to refer to them is via the CVE names to avoid confusion.

I chuckled a bit, but im also sad that we ended up in this situation. The obsession with brands is, to some extent, unhealthy.

[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by dom96 on Tuesday November 01, 2022 @01:15PM (#33424148)
Maybe we should set up a naming system just like for COVID variants
[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by tptacek on Tuesday November 01, 2022 @01:15PM (#33424151)
No, it's not. Branded vulnerabilities are memorable. CVE numbers aren't.
[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by _jal on Tuesday November 01, 2022 @01:41PM (#33424596)
Only for major problems, and even then it seems iffy. I have trouble remembering which specific issue Meltdown actually refers to a couple years on.

Personally, I'm totally fine with CVEs. (And if people to stop acting like QIDs are interchangeable, that would be great, too.)

[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by tptacek on Tuesday November 01, 2022 @01:43PM (#33424625)
You would have no connection to the underlying vulnerability whatsoever if I just mentioned CVE-2017-5754 to you.
[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by _jal on Tuesday November 01, 2022 @01:50PM (#33424747)
No, but I can establish context in about 10 seconds, and then it doesn't matter.

And you won't remember what WhizzyBadBug refers to in 5 years, you'll have to look it up. It'll only take you 10 seconds or so.

[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by tptacek on Tuesday November 01, 2022 @02:02PM (#33424919)
I don't know. The example you chose was Meltdown. I think most people in the field heard Meltdown and can at least place it into the right bucket, of microarchitectural attacks. But more to the point: Meltdown in the moment was far more useful than a CVE number.
[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by juliusdavies on Tuesday November 01, 2022 @05:59PM (#33428170)
Without looking: Struts !!!! But not 100% sure I got it right.

Update: And I'm completely wrong. :-)

[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by ASalazarMX on Tuesday November 01, 2022 @01:38PM (#33424549)
It's not a real critical vulnerability unless it has a marketable name and a its own website. Technical names are boring.

While it's cool to talk about heartbleed and people knowing what it was (it even had its own XKCD comic), I fear this marketing trend is detrimental because it's not really aimed at the people who apply the patches/mitigations.

[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by blueflow on Tuesday November 01, 2022 @07:12PM (#33429068)
The branding does not help the patching, its for self-promotion of security people. Its incentives go into the wrong direction.
[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by nequo on Tuesday November 01, 2022 @01:17PM (#33424190)
It probably serves them better that they haven't. It'd turn it into a meme like Heartbleed that would not be forgotten for the next decade.
[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by userbinator on Tuesday November 01, 2022 @02:24PM (#33425268)
This is nowhere near as severe as Heartbleed. That's why it's not considered Critical (and also why it hasn't been given a special name.)
[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by excalibur on Tuesday November 01, 2022 @01:38PM (#33424546)
Since they declined to name it, we get to name it for them, right? Let's call it CertHurt.
[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by mdaniel on Tuesday November 01, 2022 @04:11PM (#33426804)
RCE-mail? Hopefully someone can work "Cert" in, but all my attempts broke up the meter of saying it

Of course, that's cheating a little since we now know that it's not _automatically_ an RCE

[ Parent | on HN ]
Re:CVE-2022-3786 and CVE-2022-3602: X.509 Email Address Buff... by jabroni_salad on Tuesday November 01, 2022 @05:00PM (#33427392)
NCSC is calling it SpookySSL but I think it is just for funsies. https://github.com/NCSC-NL/OpenSSL-2022
[ Parent | on HN ]