Re: A small backlog of vulnerabilities in Chicken Scheme

[Henri Salo <henri () nerv fi>]

On Sat, Feb 02, 2013 at 02:59:03PM +0100, Peter Bex wrote:
> Recently a handful of security bugs have been found and fixed in the
> Chicken Scheme compiler (http://www.call-cc.org).  We (the core team)
> have decided we'd like to start using CVE identifiers for the benefit
> of our users and distributions.

Nice!

> I'd also like to know if it's possible to get CVE numbers assigned
> *before* issuing a security advisory, but without immediate full
> disclosure, so an initial advisory can be complete with CVE number.
> The CVE can be updated afterwards with the link to the advisory when
> it is issued.  This should make it easier for users to find information
> about the bug.  This list's Openwall wiki seems to imply that it's
> only possible to request a CVE for an issue given all the information
> immediately, but a recent message from Kurt Seifried in a thread about
> Jenkins says that it can be done.  If it's indeed okay to e-mail Kurt
> directly, it would be helpful to include this in the documentation wiki.

http://people.redhat.com/kseifrie/CVE-OpenSource-Request-HOWTO.html

--
Henri Salo