Re: [EXT] Re: [oss-security] CVE-2023-51767: a bogus CVE in OpenSSH

[Peter Gutmann <pgut001 () cs auckland ac nz>]

Damien Miller <djm () mindrot org> writes:

> The fact that someone filed this CVE based on your paper demonstrates that it
> is misleading.

Everyone gets that at some point.  There was a discussion on another mailing
list about it a while back, how do you respond to a CVE for a vulnerability
that doesn't exist unless you modify the code or config in order to create it?
The general feeling was that it's best just to grin and bear it, you're going
to get them at some point no matter what you do.  In particular, some obscure
vuln that no-one will ever exploit only becomes publishable if you demonstrate
it against a well-known project like OpenSSL, or OpenSSL, or OpenSSL, or
OpenSSL, maybe GPG, or OpenSSL, and occasionally OpenSSH.  But almost always
OpenSSL.

The only complication I've run into was when I was contacted by a user asking
whether the problem in CVE xyz had been fixed.  That was the first time I'd
heard about it (the person who filed the CVE never bothered contacting me),
and then I had to figure out how to explain to them that there was no fix
because the vulnerability didn't exist unless you added it yourself.

Peter.