Re: Fwd: Apache HTTP Server 2.2.22 Released

[Kurt Seifried <kseifried () redhat com>]

On 01/31/2012 05:42 PM, Solar Designer wrote:
> I think that only posting to oss-security when there's not yet a CVE ID
> assigned (to request one) is weird.  I think it may be more beneficial
> to post in here about all security issues in Open Source software -
> well, or at least in widely used pieces of software.  As a special case,
> when an issue that was first discussed on the private linux-distros or
> distros lists is made public, I think this should include a posting to
> oss-security (and not only vendor advisories sent via their usual
> channels, which vary by vendor).  (No, the Apache issues below were not
> on the distros lists.)

Agreed, one thing that would be helpful is to start all CVE requests
with "CVE Request" in the subject line which will make it easy for me to
spot them. Anything informational can be whatever title (like what Solar
Designer sent).

On the other hand how much overlap do we want with full-disclosure/bugzilla?

-- 
Kurt Seifried Red Hat Security Response Team (SRT)