Re: Contributing Back

[Zhang Xiao <xiao.zhang () windriver com>]

Hi Alexander,

在 2020/7/12 上午1:58, Solar Designer 写道:
> Hi Xiao,
>
> On Thu, Jul 02, 2020 at 05:33:20PM +0800, Zhang Xiao wrote:
> > I am an engineer of WindRiver. Thanks for Alexander's remind about the distribution and we would like to "backup" 
> > the first item of the administrative list:
> > https://oss-security.openwall.org/wiki/mailing-lists/distros#contributing-back
> >
> > 1. Promptly review new issue reports for meeting the list's requirements and confirm receipt of the report and, when 
> > necessary, inform the reporter of any issues with their report (e.g., obviously not actionable by the distros) and 
> > request and/or propose any required yet missing information (most notably, a tentative public disclosure date/time) 
> > /- primary: Oracle, backup: vacant /
> > Please let me know how we get started helping out.
> I've just added Wind River as backup for this role.  Please watch for
> issues on which Oracle (and others) haven't provided an initial response
> to the reporter or where such response is incomplete (per the above),
> and provide your own response (CC'ing the list) whenever that happens.
Thank you, we will make it.
> > And, I have another point want to discuss. As we know, sometimes, the CVE and NVD website don't upgrade their web 
> > page timely. For example:
> >
> > the security maillist had an encrypted mail called "curl: overwrite local file with -J" in 20200617. It was a 
> > "pre-notification about a security advisory about to ship next week in sync with our next curl release", for 
> > CVE-2020-8177. On curl's git tree, that very bug did been fixed and released in 20200621:
> > https://github.com/curl/curl/commit/8236aba5854
> >
> > But, till now, both cve.mitre.org and nvd.nist.gov still mark this CVE as "RESERVED":
> > https://nvd.nist.gov/vuln/detail/CVE-2020-8177
> > https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8177
> >
> > So I wonder if that is also an contribution to remind them, if so, any advises to make it? And If it ca be defined 
> > as an contribution, we can take it. :-)
> We've received some responses in this thread regarding the specific
> example above, but I'd like more general responses please.  Is there a
> general task Wind River can reasonably help with for getting CVE details
> published for issues that pass the distros and/or oss-security lists,
> and how exactly could they help with that?

Actually, we are glad to make it for some customers are also pay
attention on these official web pages. We suppose it will be easy to
make it through the "notify a vulnerability publication
<https://cveform.mitre.org/>". But after I submitted the request I just
get a reply as "This CVE ID has been reserved by the CNA Hackerone and
we are currently waiting on them to submit the details." Seems only "the
CNA Hackerone" can make it. I have no idea on how to notify the "the CNA
Hackerone " to push it. :-(  Anyway, if possible we are glad to make it.


Thanks

Xiao


> Thanks,
>
> Alexander

Attachment: pEpkey.asc
Description: