Re: Buffer Overflow in raptor widely unfixed in Linux distros

[Sam James <sam () cmpct info>]

> On 16 Nov 2020, at 18:50, Stephen John Smoogen <smooge () gmail com> wrote:
>
> On Mon, 16 Nov 2020 at 12:44, David A. Wheeler <dwheeler () dwheeler com>
> wrote:
>
> > > [snip]
> >
> > I think this is key. If you find a vulnerability, you typically need to
> > ensure that it gets
> > a CVE assigned if you want coordination & resolution to happen. It's how
> > coordination happens.
> > There are issues with CVEs, but I’ve never seen a CVE assignment
> > get dropped in recent years once it was requested properly.
> > Delayed, yes, but I know CVE assignments don’t take 3 years :-).
> > And yes, there are special issues with the Linux kernel, but this package
> > isn’t the Linux kernel.
> >
> > If you think that CVE assignment is still of “fluctuating reliability” I’d
> > like to hear that argument
> > and get it fixed. It’s normally better to fix the standard process for
> > doing something than
> > to create yet another process that runs in parallel. I’ve seen no recent
> > evidence of this reliability issue.
> My guess is that there was an assumption that if an email with a
> vulnerability was sent to this list, someone would do the CVE filing for
> them. Looking through my archives, there are times where someone posts a
> vulnerability and miraculously someone says shortly "Please use
> CVE-2XXX-YYYY for all future announcements." If you aren't on the lists all
> the time or know that various groups do this full time, there is no clue
> that there was some sort of extra work done to get that number... it just
> looks like it was done as a service. When a person posts a vulnerability
> and then gets no extra emails.. then it looks like a secret society. "Oh
> you forgot to shake Smooge's hand with your middle finger hooked and your
> pinky out... can't give you a CVE"

There’s a webform where you can apply and the folks are quite good at replying
with helpful comments & feedback if needed.

But I can see why someone might get that impression.

> > Sing this (to “Single Ladies”):
> > "If you like it, then you shoulda put a CVE on it...:"
> >
> > --- David A. Wheeler
>
> -- 
> Stephen J Smoogen.