Re: MySQL CVEs (was: Security vulnerability in MySQL/MariaDB sql/password.c)

["Steven M. Christey" <coley () rcf-smtp mitre org>]

All,

I'm really not sure about the best way to handle this.  We definitely want 
to avoid duplicates or triplicates as much as possible.

I of course don't speak for Oracle, but they are generally reluctant to 
comment on CVE mappings or exploit details in any public forum (although 
they have privately provided CVEs to the original researchers if asked). 
I will discuss this issue with them using existing CVE communication 
channels, but I'm not sure when I will have an answer or clarification 
that resolves this complicated interaction between open source and closed 
source philosophies.

Meanwhile, I will ensure that we have updates for the already-assigned 
CVEs that are not covered in Oracle CPUs, and note the *potential* 
duplicates in the descriptions, along with the usual statement that 
emphasizes that Oracle has not commented.

- Steve