RE: Ruby CVEs

["Christey, Steven M." <coley () mitre org>]

I agree with Alexander.  The CVE assignment process is never intended to introduce unnecessary delays to the 
publication of vulnerability information.  Merely noting whether CVEs have already been requested should reduce most of 
the risk of duplicates without forcing people to delay publication.

- Steve


> -----Original Message-----
> From: Solar Designer [mailto:solar () openwall com]
> Sent: Wednesday, March 20, 2013 10:58 PM
> To: larry Cashdollar
> Cc: oss-security () lists openwall com; kseifried () redhat com
> Subject: Re: [oss-security] Ruby CVEs
>
> [snip]
> Overall, I think all of you have tried to do the right thing, and I
> would not want to have information withheld from this list merely to
> avoid duplicate CVE IDs in the future.  CVEs are handy, but the CVE
> assignment process should not affect what is posted publicly and when.