oss-sec mailing list archives
Re: why many CVEs are ** RESERVED ** on Mitre
From: Kurt Seifried <kseifried () redhat com>
Date: Wed, 14 Dec 2016 07:24:19 -0700
On Wed, Dec 14, 2016 at 1:44 AM, Sona Sarmadi <sona.sarmadi () enea com> wrote:
Hi again, Does anyone know why Mitre lists many CVEs ** RESERVED ** while they are public (e.g. curl CVEs below)?
As per https://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures#Description Description[edit] This is a standardized text description of the issue(s). One common entry is: ** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided. This means that the entry number has been reserved by Mitre for an issue or a CNA has reserved the number. So in the case where a CNA requests a block of CVE numbers in advance (e.g. Red Hat currently requests CVEs in blocks of 500), the CVE number will be marked as reserved even though the CVE itself may not be assigned by the CNA for some time. Until the CVE is assigned AND Mitre is made aware of it (e.g. the embargo passes and the issue is made public), AND Mitre has researched the issue and written a description of it, entries will show up as "** RESERVED **". The good news is this is changing (MITRE will be able to accept descriptions/data from other parties at some point). I don't have an exact time frame though.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8615 https://curl.haxx.se/docs/security.html: CVE-2016-8615 CVE-2016-8616 CVE-2016-8617 CVE-2016-8618 CVE-2016-8619 CVE-2016-8620 CVE-2016-8621 CVE-2016-8622 CVE-2016-8623 CVE-2016-8624 CVE-2016-8625 Shouldn't Mitre follow a process and update the page after CVEs have been made public e.g. by upstream project? Or perhaps there is another reason for these CVEs not to be updated? Best, --------------------------------------- Sona Sarmadi Security Responsible for Enea Linux
-- -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Red Hat Product Security contact: secalert () redhat com
Current thread:
- why many CVEs are ** RESERVED ** on Mitre Sona Sarmadi (Dec 14)
- Re: why many CVEs are ** RESERVED ** on Mitre Kurt Seifried (Dec 14)
- Re: why many CVEs are ** RESERVED ** on Mitre Sevan Janiyan (Dec 14)
- Re: why many CVEs are ** RESERVED ** on Mitre Kurt Seifried (Dec 14)
- Re: why many CVEs are ** RESERVED ** on Mitre Sevan Janiyan (Dec 14)
- Re: why many CVEs are ** RESERVED ** on Mitre Marcus Meissner (Dec 14)
- Re: why many CVEs are ** RESERVED ** on Mitre Kurt Seifried (Dec 14)
- Re: why many CVEs are ** RESERVED ** on Mitre Sona Sarmadi (Dec 14)
- Re: why many CVEs are ** RESERVED ** on Mitre Sevan Janiyan (Dec 14)
- Re: why many CVEs are ** RESERVED ** on Mitre Kurt Seifried (Dec 14)