Re: discourage "CVE only" use of (linux-)distros

[Kurt Seifried <kseifried () redhat com>]

On 04/13/2015 08:41 AM, Solar Designer wrote:
> Hi,
>
> I've just added the below paragraph:
>
> My opinion is that CVEs are not that important to request them before
> making the issue public, unless this can easily be done without placing
> the vulnerability information at extra risk - e.g., if it's actionable
> for (linux-)distros anyway, and the CVE ID assignment can happen as a
> nice extra there, or if MITRE can assign them without obtaining detail.
>
> Another aspect is that, if I understood correctly, MITRE is currently
> slow at CVE ID assignments, and distros is way quicker.  This may be
> driving CVE requests to distros, too.  More importantly, a concern is
> that slow CVE ID allocation by MITRE might delay public disclosure of
> issues by those reporters who really want to have CVE IDs on their
> advisories, etc.  I think they should not actually delay anything for
> that minor reason alone, but that's just me.  The reality might be that
> they do delay.

As per https://github.com/RedHatProductSecurity/CVE-HOWTO people that
want a CVE for Open Source software can go to secalert () redhat com, the
advantage being that distribution is limited to Red Hat internal product
security only) and we'll see it quickly. Should I maybe remove/amend the
oss-security list description?

As for how much information is required to assign a CVE, speaking for
myself, "it depends". Mostly on displayed competency and trust and
simplicity of the request. E.g. if you want a single CVE for a single
issue and you're a generally well known security person, or especially
known to me personally then you'll get your CVE pretty quickly usually I
just need a rough title (so I have something to put in the file we store
CVE #'s so we know what it was assigned to and do a duplicate later on).
OTOH if you're not as well known or the request is more complex (e.g.
multiple issues with overlaps, so CVE SPLIT/MERGE needs to be done) we
may need more details up to and including patches, but this is less common.

I don't know what Mitre requires, but I know they deal with proprietary
software and I assume many of the larger firms don't give them many if
any details (based on post assignment write ups in the cve database) so
for "0 knowledge" CVE's Mitre appears to be an option.

> Alexander

P.S. I'll be at RSA2015 next week, probably easiest to contact me via
twitter PM (my phone isn't setup for work email) if you wanna meet for a
beer or whatever.

-- 
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Attachment: signature.asc
Description: OpenPGP digital signature