Re: Linux kernel CVEs not mentioned on oss-security

[Marcus Meissner <meissner () suse de>]

Hi,

Underlined _YES_ to that.

It is very easy to do this if you see something, do not get distracted by the amount of fields
as most are optional.

This is lowcost detached effort.

Ciao, Marcus
On Tue, Sep 26, 2017 at 02:03:30PM -0600, Kurt Seifried wrote:
> If you see this: PLEASE SUBMIT THE URL AS AN UPDATE TO THE CVE USING THE
> CVE FORM (yes, I am shouting).
>
> https://cveform.mitre.org
>
> Choose "Request an update to an existing CVE entry" and then for "Type of
> update requested" choose "Update References" and then eneter the CVE #, the
> ifo and URL and hit "Submit Request"
>
> TL;DR: Everyone wants the cat to wear a bell, and in past I'll admit we
> (the CVE community) didn't make it easy to contribute. Well now we have
> made it easy to contribute, so please do.
>
>
> On Tue, Sep 26, 2017 at 1:07 PM, Agostino Sarubbo <ago () gentoo org> wrote:
>
> > On martedì 26 settembre 2017 20:18:38 CEST Kurt Seifried wrote:
> > > You can check the CVE Database? There is the official MITRE one:
> > > cve.mitre.org and the DWF for Open Source (and yes, I lag in
> > submissions to
> > > MITRE) at https://github.com/distributedweaknessfiling/DWF-CVE-Database/
> > in
> > > both cases the CVEs will have reference link(s) that ideally point to the
> > > upstream making it easy to match up.
> >
> > As pointed out in the past (maybe spender?) the real issue is when there
> > is a
> > silent fix of a vulnerability where the commit message does not clearly
> > state
> > about the security implication. Afaik it happens frequently.
> >
> > --
> > Agostino Sarubbo
> > Gentoo Linux Developer
>
>
>
> -- 
>
> Kurt Seifried -- Red Hat -- Product Security -- Cloud
> PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
> Red Hat Product Security contact: secalert () redhat com

-- 
Marcus Meissner,SUSE LINUX GmbH; Maxfeldstrasse 5; D-90409 Nuernberg; Zi. 3.1-33,+49-911-740 
53-432,,serv=loki,mail=wotan,type=real <meissner () suse de>