oss-sec mailing list archives
Re: Buffer Overflow in raptor widely unfixed in Linux distros
From: Sam James <sam () cmpct info>
Date: Mon, 16 Nov 2020 19:42:17 +0000
On 16 Nov 2020, at 18:50, Stephen John Smoogen <smooge () gmail com> wrote: On Mon, 16 Nov 2020 at 12:44, David A. Wheeler <dwheeler () dwheeler com> wrote:[snip]I think this is key. If you find a vulnerability, you typically need to ensure that it gets a CVE assigned if you want coordination & resolution to happen. It's how coordination happens. There are issues with CVEs, but I’ve never seen a CVE assignment get dropped in recent years once it was requested properly. Delayed, yes, but I know CVE assignments don’t take 3 years :-). And yes, there are special issues with the Linux kernel, but this package isn’t the Linux kernel. If you think that CVE assignment is still of “fluctuating reliability” I’d like to hear that argument and get it fixed. It’s normally better to fix the standard process for doing something than to create yet another process that runs in parallel. I’ve seen no recent evidence of this reliability issue.My guess is that there was an assumption that if an email with a vulnerability was sent to this list, someone would do the CVE filing for them. Looking through my archives, there are times where someone posts a vulnerability and miraculously someone says shortly "Please use CVE-2XXX-YYYY for all future announcements." If you aren't on the lists all the time or know that various groups do this full time, there is no clue that there was some sort of extra work done to get that number... it just looks like it was done as a service. When a person posts a vulnerability and then gets no extra emails.. then it looks like a secret society. "Oh you forgot to shake Smooge's hand with your middle finger hooked and your pinky out... can't give you a CVE"
There’s a webform where you can apply and the folks are quite good at replying with helpful comments & feedback if needed. But I can see why someone might get that impression.
Sing this (to “Single Ladies”): "If you like it, then you shoulda put a CVE on it...:" --- David A. Wheeler-- Stephen J Smoogen.
Current thread:
- Buffer Overflow in raptor widely unfixed in Linux distros Hanno Böck (Nov 13)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros David A. Wheeler (Nov 13)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros Dave Horsfall (Nov 14)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros Dave Horsfall (Nov 14)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros Ian Zimmerman (Nov 18)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros Dave Horsfall (Nov 14)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros Marcus Meissner (Nov 14)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros David A. Wheeler (Nov 16)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros Stephen John Smoogen (Nov 16)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros Sam James (Nov 16)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros Marius Bakke (Nov 16)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros Jeremy Stanley (Nov 16)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros Sam James (Nov 16)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros Seth Arnold (Nov 16)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros Marcus Meissner (Nov 17)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros Morten Linderud (Nov 17)
- Re: Buffer Overflow in raptor widely unfixed in Linux distros David A. Wheeler (Nov 16)