Re: Contributing Back

[Francis Perron <francisp () google com>]

Xiao -
  this delay may be possible due to many things, but the simplest
possibility that comes to mind is that Daniel (here cc'd) from H1 has only
gotten a reservation of CVE number, and he and MITRE have not triggered the
submission yet.

The classic turnaround with MITRE submissions (via the webform) is less
than 48h from my experience, so when we're seeing weeks of delays, it
typically means MITRE has not been told to publish it yet.


Hope that helps,

On Thu, Jul 2, 2020 at 12:07 PM Zhang Xiao <xiao.zhang () windriver com> wrote:

> Hi All,
>
> I am an engineer of WindRiver. Thanks for Alexander's remind about the distribution and we would like to "backup" the 
> first item of the administrative list:https://oss-security.openwall.org/wiki/mailing-lists/distros#contributing-back
>
> 1. Promptly review new issue reports for meeting the list's requirements and confirm receipt of the report and, when 
> necessary, inform the reporter of any issues with their report (e.g., obviously not actionable by the distros) and 
> request and/or propose any required yet missing information (most notably, a tentative public disclosure date/time) 
> *- primary: Oracle, backup: vacant
> *
> Please let me know how we get started helping out.
>
> And, I have another point want to discuss. As we know, sometimes, the CVE and NVD website don't upgrade their web 
> page timely. For example:
>
> the security maillist had an encrypted mail called "curl: overwrite local file with -J" in 20200617. It was a 
> "pre-notification about a security advisory about to ship next week in sync with our next curl release", for 
> CVE-2020-8177. On curl's git tree, that very bug did been fixed and released in 
> 20200621:https://github.com/curl/curl/commit/8236aba5854
>
> But, till now, both cve.mitre.org and nvd.nist.gov still mark this CVE as 
> "RESERVED":https://nvd.nist.gov/vuln/detail/CVE-2020-8177https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8177
>
> So I wonder if that is also an contribution to remind them, if so, any advises to make it? And If it ca be defined as 
> an contribution, we can take it. :-)
>
>
> Thanks
> Xiao

-- 
Francis Perron
  Vulnerability Coordination @ Google inc.