Re: Re: Duplicate CVE: CVE-2015-7703 in NTP

[Kurt Seifried <kseifried () redhat com>]

On Fri, Oct 23, 2015 at 10:06 AM, <cve-assign () mitre org> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> > It seems that NTP upstream has also requested a CVE (and had one
> > assigned) for this issue:
> >
> > Bug 2902 : CVE-2015-7703 configuration directives "pidfile" and
> "driftfile" should only be allowed locally. (RedHat)
> > [
> http://support.ntp.org/bin/view/Main/SecurityNotice#October_2015_NTP_Security_Vulner
> ]
> > However, Red Hat assigned CVE-2015-5196 to this issue when it was first
> > discovered:
> >
> > https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-5196
> >
> > Can CVE-2015-7703 please be rejected?
>
> Actually, we have rejected CVE-2015-5196 and are keeping CVE-2015-7703.
>
> This is a case where we have a long-standing published policy (see the
> http://cve.mitre.org/cve/editorial_policies/duplicates.html page) and
> our implementation of step 1 chose CVE-2015-7703.
>
> We will update our internal documentation for CVE assignments to
> further emphasize the possibility that a CVE ID may have already been
> assigned outside of MITRE, to try to avoid this type of unfortunate
> situation in the future.
>
>
> I'm going to also ensure we communicate our CVE's to upstreams, I could
swear we did in this case but I can't find a specific artifact (e.g. sent
email) of doing so from myself (but quite often I just assign the CVE and
other people are handling the issue so that wouldn't be to abnormal) so I'm
going to go on the assumption we failed to do so properly and update our
process as well to ensure we do.



-- 

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert () redhat com