Re: CVE-2022-21449 and version reporting

[John Helmert III <ajak () gentoo org>]

On Sat, Apr 30, 2022 at 01:24:36PM +0200, Christian Fischer wrote:
>  > It’s not that they didn’t/can’t verify, it’s already verified, 
> they’re claiming those versions no longer being officially supported 
> means they can seemingly omit them from CVE reporting.
>  >
>  > Which is dangerous, misleading, and nonsensical.
>
> While i fully agree with this be aware that CVE entries could generally 
> contain incomplete information:
>
> After requesting an update of a CVE entry via the MITRE CVE forum in the 
> past to add additional affected products for a different vendor (which 
> wasn't even the assigning CNA like it is the case for Oracle here) my 
> request was rejected by MITRE with the following rationale given:

The CNA that assigned that CVE is Oracle, so Oracle is the CNA to talk
to to make changes to it. MITRE won't make changes to it as they're
not the CNA behind that CVE.

>  > A CVE description does not necessarily contain all the affected 
> products or versions and is not part of CVE ID requirements. The 
> products are documented in the CVE references.
> This is also matching my experiences with various other products / 
> vendors and related CVE entries for these.

Right, this is documented in the CNA rules [1]:

"8.2.1 MUST provide enough information for a reader to have a
reasonable understanding of what products are affected. If the
affected products are not explicitly listed in the description, then
the CNA MUST provide a reference that points to the known affected
products."

[1] https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_8-2_cve_record_prose_description_requirements

Attachment: signature.asc
Description: