Re: Re: CVE request for OpenStack Compute (nova)

[Jeremy Stanley <jeremy () openstack org>]

On 2015-03-24 03:36:10 -0400 (-0400), cve-assign () mitre org wrote:
[...]
> So, does the OpenStack VMT have a position on whether to choose this
> latter scenario? In other words, if live migration fails because of a
> disconnected physical network interface, is access control for volumes
> intentionally undefined afterward?

As a member of the OpenStack VMT, I have no opinion on this. We
don't generally express an opinion on whether a bug report _can_
have an associated CVE, only on whether the bug is associated with
an attack scenario we deem likely enough to warrant the effort
expended in discussing and fixing it under embargo, backporting to
supported stable branches, then creating and publishing a formal
security advisory. Of the many reports we initially receive as
potential vulnerabilities, only a fraction actually end in an
advisory as opposed to being considered a security hardening
opportunity.
-- 
Jeremy Stanley

Attachment: signature.asc
Description: Digital signature