oss-sec mailing list archives
Re: CVE Requests
From: Tim Brown <tmb () 65535 com>
Date: Fri, 16 Mar 2012 19:57:20 +0000
On Friday 16 Mar 2012 19:45:58 Kurt Seifried wrote:
You may have uh noticed me assigning 200+ cve's in the last few months. I took over for Josh. I am unwilling to public assign CVE's that are likely to end up with duplicates (e.g. no information CVE's already sent in as a request to Mitre). I am quite happy to assign "secret" or whatever you want to call them CVE's (I do it all the time on linux-distros list for embargoed issues) but I'm also trying to avoid duplicates and other messes. If the issue is so secret you can't even give me a version #, brief description, etc. than chances are Mitre needs to handle it. I'm asking for pretty basic info like version #'s affected and ideally fixed if you got it. This doesn't need to be complicated.
Thanks for the clarification. Josh has in the past been very useful with OpenVAS and KDE bugs in particular where there is a security team who can take up most of the slack and handle the co-ordination process. Hopefully we won't notice any changeover when we deal with you. Totally agree about the information aspect FWIW, never had a problem sharing in the past - it's just a matter of minimising the friction when disclosing. Cheers, Tim PS I suspect I'll be in touch sooner rather than later about CVEs, got a handful that are almost ready for disclosure. -- Tim Brown <mailto:tmb () 65535 com>
Attachment:
signature.asc
Description: This is a digitally signed message part.
Current thread:
- Re: CVE Requests, (continued)
- Re: CVE Requests Solar Designer (Mar 16)
- Re: CVE Requests Kurt Seifried (Mar 16)
- Re: CVE Requests Mark Stanislav (Mar 16)
- Re: CVE Requests Kurt Seifried (Mar 16)
- Re: CVE Requests Andreas Ericsson (Mar 16)
- Re: CVE Requests Adam D. Barratt (Mar 16)
- Re: CVE Requests Mark Stanislav (Mar 16)
- Re: CVE Requests Tim Brown (Mar 16)
- Re: CVE Requests Mark Stanislav (Mar 16)
- Re: CVE Requests Kurt Seifried (Mar 16)
- Re: CVE Requests Tim Brown (Mar 16)
- Re: CVE Requests Eugene Teo (Mar 18)
- Re: CVE Requests Kurt Seifried (Mar 16)
- Re: CVE Requests Andreas Ericsson (Mar 19)