oss-sec mailing list archives
Re: CVE Requests
From: Mark Stanislav <mark.stanislav () gmail com>
Date: Fri, 16 Mar 2012 12:11:04 -0400
All points being made are very much valid and I certainly understand how contextually oss-sec may be used to allocation requests under different circumstances. So here's my situation, I'm up for suggestions (of which, "wait longer", is perfectly viable!)... 1) March 1st, I sent 2 of these CVEs over to Steve Christy at MITRE who had previously allocated 9 prior CVEs in a day or two generally 2) March 8th, after not hearing back from Steve, I contacted cve@mitredirectly with all 5 3) March 15th, after not hearing back from MITRE, I contacted Kurt off list as I've noted his helpfulness doing allocations 3a) Kurt pointed me to email the list, rather than him directly (which is perfectly fine, but perhaps not the context I was aiming for initially) So we're moving past two weeks, I have 5 CVEs I am trying to allocate and talk with all of these developers to get on the same page which. None of these vulnerabilities are exactly going to rock the security world (see: CVE-2012-0002) but I'd love to be able to handle the process as MITRE intends (Introduction to CVE Identifier Reservation - http://cve.mitre.org/cve/cna.html) as I have previously 9 times with a lot of success. I apologize if these requests fell outside of the regular scope of the list, but at this point I am just trying to get this process done with :) -Mark On Fri, Mar 16, 2012 at 11:54 AM, Adam D. Barratt <adam () adam-barratt org uk>wrote:
On 16.03.2012 10:26, Andreas Ericsson wrote:Those mails are all exemplary requests for CVE id's, ofcourse, but the fact that they are all already fixed and released means that 100% of the work is already done. At that point, assigning a CVE id is mostly useless and is done as a "just for the record" thing.Whether you consider it useless or not, those are the CVE assignments that will happen on the list, aiui. http://oss-security.openwall.**org/wiki/mailing-lists/oss-**security<http://oss-security.openwall.org/wiki/mailing-lists/oss-security>specifically says: "Public security issues only please. What you say here is public for the world to see - keep that in mind. Embargoed information is best disclosed to vendor-sec" (which should be updated to point at somewhere that actually exists). Regards, Adam
Current thread:
- Re: CVE Requests, (continued)
- Re: CVE Requests Kurt Seifried (Mar 15)
- Re: CVE Requests Mark Stanislav (Mar 15)
- Re: CVE Requests Kurt Seifried (Mar 15)
- Re: CVE Requests Mark Stanislav (Mar 15)
- Re: CVE Requests Solar Designer (Mar 16)
- Re: CVE Requests Kurt Seifried (Mar 16)
- Re: CVE Requests Mark Stanislav (Mar 16)
- Re: CVE Requests Kurt Seifried (Mar 16)
- Re: CVE Requests Andreas Ericsson (Mar 16)
- Re: CVE Requests Adam D. Barratt (Mar 16)
- Re: CVE Requests Mark Stanislav (Mar 16)
- Re: CVE Requests Tim Brown (Mar 16)
- Re: CVE Requests Mark Stanislav (Mar 16)
- Re: CVE Requests Kurt Seifried (Mar 16)
- Re: CVE Requests Tim Brown (Mar 16)
- Re: CVE Requests Eugene Teo (Mar 18)
- Re: CVE Requests Kurt Seifried (Mar 16)
- Re: CVE Requests Andreas Ericsson (Mar 19)