oss-sec mailing list archives
Re: Closed list
From: akuster <akuster () mvista com>
Date: Wed, 01 Jun 2011 08:52:14 -1000
On 06/01/2011 06:34 AM, Solar Designer wrote:
Hi Armin, On Thu, May 26, 2011 at 05:42:00AM -1000, akuster wrote:You can find our security Advisories at: http://www.mvista.com/cve_vulnerabilities.php I have updated http://oss-security.openwall.org/wiki/vendors http://oss-security.openwall.org/wiki/distro-patchesThanks. I've just reviewed the above and subscribed you to the list. I have some "complaints", though:
No worries.
http://www.mvista.com/cve_vulnerabilities.php gives a mapping of CVE IDs to affected MontaVista products. That's great. However, fix information is missing. Does having a CVE ID listed there imply that you have fixed the issue for those affected products or not (e.g., perhaps not for EOL'ed products, or are you not listing those as affected at all)?
Yes, having the cve listed means it is fixed. Specifically relevant to this discussion would be the
dates on which you're getting issues fixed (such that those could be compared to CRDs to see if you likely made use of the advance notifications or not). Right now, you have "Published" and "Modified" dates, but no fix dates (which would be per product?)
Good input. I will put that on my list for version 2 requirements.
Also, no info on 2011's CVEs yet. Does this mean we'd have to wait until 2012 to get an idea on how you're handling 2011's security issues?
Correct. I have an internal business requirement to delay public notifications for 6 months in order to give our customers time to propagate our fixes to their customers. If our internal processes are working, then 2011 CVE's should start showing up sometime this month.
That said, you do look like a security-conscious Linux distro vendor now (and you meet some other requirements), so you're on the list.
Many thanks. Armin
Current thread:
- Re: Closed list, (continued)
- Re: Closed list Michael Gilbert (Apr 12)
- Re: Closed list akuster (Apr 12)
- Re: Closed list Ronald van den Blink (Apr 13)
- Re: Closed list akuster (Apr 13)
- Re: Closed list Ronald van den Blink (Apr 13)
- Re: Closed list akuster (Apr 12)
- Re: Closed list akuster (May 26)
- Re: Closed list Dan Rosenberg (May 26)
- Re: Closed list akuster (May 26)
- Re: Closed list Solar Designer (Jun 01)
- Re: Closed list akuster (Jun 01)
- Re: Closed list Solar Designer (Apr 12)
- [security-vendor] Re: [oss-security] Closed list Zhao, Zhenfeng (Apr 14)
- [security-vendor] Re: [oss-security] Closed list Zhao, Zhenfeng (Apr 15)
- Re: Closed list Solar Designer (Apr 24)
- Re: Closed list Solar Designer (Apr 24)
- Re: Closed list Solar Designer (Apr 12)