Re: CVE request

[Michael Gilbert <michael.s.gilbert () gmail com>]

On Tue, 18 Jan 2011 16:53:51 +0000, Tim Brown wrote:
> On Tuesday 18 January 2011 16:40:42 Michael Gilbert wrote:
> > On Tue, 18 Jan 2011 12:22:05 +0000, Tim Brown wrote:
> > > Guys,
> > >
> > > What's the best way for an open source project to request a CVE prior to
> > > disclosure?  I'm more that happy to coordinate the disclosure with
> > > distributions where appropriate if that makes a difference.
> >
> > You're looking for vendor-sec:
> > http://oss-security.openwall.org/wiki/mailing-lists/vendor-sec
>
> That's a closed list though isn't it?  If anyone wants to sponsor me on to it, 
> I'm willing to put my OpenVAS hat on and jump through the necessary hoops :)

There are some notes at the bottom of the above page that describe what
to do if you are not a vendor-sec member.

Best wishes,
Mike