Re: Additional information on CVE-2014-2469?

[Tomas Hoger <thoger () redhat com>]

On Mon, 21 Jul 2014 11:19:21 -0700 Ritwik Ghoshal wrote:

> > Is there anyone from Oracle on the list? Does anyone have further
> > information on CVE-2014-2469?
> > https://blogs.oracle.com/sunsecurity/entry/cve_2014_2469_denial_of
>
> As far as we know CVE-2014-2469 affects lighttpd in Solaris only. I
> have fixed the typo in our advisory. Thank you for pointing it out.

Is there a good reason to not provide any actionable details?  Flaw
details and/or patch link (I'm assuming this got corrected upstream
too).  It's not uncommon for vendors fixing a vendor-specific issue to
send a heads-up here and to upstream rather than letting everyone else
using affected component to struggle trying to find any details.  In
this case, you don't even seem to know if it actually was vendor
specific.

Can Oracle ensure that actionable details are provided for any Oracle
assigned CVEs for open-source components?  Regardless of who the
upstream is.  MySQL is a good example - there were previous requests to
provide at least minimal details to unambiguously map assigned CVEs to
specific issues, all refused or ignored.  This is a good place to share
such information.

-- 
Tomas Hoger / Red Hat Security Response Team