Re: Buffer Overflow in raptor widely unfixed in Linux distros

[Stephen John Smoogen <smooge () gmail com>]

On Mon, 16 Nov 2020 at 12:44, David A. Wheeler <dwheeler () dwheeler com>
wrote:

> > On Fri, Nov 13, 2020 at 01:33:31PM +0100, Hanno Böck wrote:
> > > 3 years ago I reported a heap overflow vulnerability in raptor, an RDF
> > > parsing library:
> > > https://www.openwall.com/lists/oss-security/2017/06/07/1 <
> https://www.openwall.com/lists/oss-security/2017/06/07/1> ,,,
> > > Maybe noteworthy is that this didn't get a CVE in 2017. It seems many
> > > distros rely on CVEs to get a process of backporting fixes rolling.
> > > Given the fluctuating reliability of CVE assignments not sure this is
> > > wise. I have now requested a CVE (CVE-2017-18926).
> ...
>
> > On Nov 14, 2020, at 6:58 AM, Marcus Meissner <meissner () suse de> wrote:
> > I think the only thing you can do additional is to request a CVE.
> >
> > All tracking by everyone is using CVEs, this is the core identifier
> > of the software security world.
>
> I think this is key. If you find a vulnerability, you typically need to
> ensure that it gets
> a CVE assigned if you want coordination & resolution to happen. It's how
> coordination happens.
> There are issues with CVEs, but I’ve never seen a CVE assignment
> get dropped in recent years once it was requested properly.
> Delayed, yes, but I know CVE assignments don’t take 3 years :-).
> And yes, there are special issues with the Linux kernel, but this package
> isn’t the Linux kernel.
>
> If you think that CVE assignment is still of “fluctuating reliability” I’d
> like to hear that argument
> and get it fixed. It’s normally better to fix the standard process for
> doing something than
> to create yet another process that runs in parallel. I’ve seen no recent
> evidence of this reliability issue.
My guess is that there was an assumption that if an email with a
vulnerability was sent to this list, someone would do the CVE filing for
them. Looking through my archives, there are times where someone posts a
vulnerability and miraculously someone says shortly "Please use
CVE-2XXX-YYYY for all future announcements." If you aren't on the lists all
the time or know that various groups do this full time, there is no clue
that there was some sort of extra work done to get that number... it just
looks like it was done as a service. When a person posts a vulnerability
and then gets no extra emails.. then it looks like a secret society. "Oh
you forgot to shake Smooge's hand with your middle finger hooked and your
pinky out... can't give you a CVE"





> Sing this (to “Single Ladies”):
> "If you like it, then you shoulda put a CVE on it...:"
>
> --- David A. Wheeler

-- 
Stephen J Smoogen.