Re: Numerous unconfirmed FOSS CVEs disclosed on FD mailing list

[Matthew Fernandez <matthew.fernandez () gmail com>]

On 2/1/24 19:54, Amos Jeffries wrote:
> On 27/01/24 12:03, Matthew Fernandez wrote:
> > On 1/27/24 08:53, Alan Coopersmith wrote:
> > > While I can't speak for all the projects involved, I can speak for the
> > > X.Org maintainers & security team, and I can say that we were not
> > > consulted or informed about this CVE filing - if I wasn't on the FD
> > > mailing list, I wouldn't even know it had happened.  The CNA responsible
> > > has not yet published the CVE to the CVE database yet, so we can't yet
> > > file a dispute, but once they do, I plan to request that they withdraw
> > > CVE-2023-45916 for xedit, as there is no security boundary crossed here
> > > and the bug doesn't allow someone to do anything they otherwise 
> > > couldn't.
> >
> > We (the Graphviz maintainers) were also not consulted/informed. Though 
> > we do not plan to contest the CVE.
>
>
> Please *DO* contest CVE issued for non-security bugs. It helps 
> discourage this kind of bad behaviour if their CVEs get removed. May 
> also help CNA to identify repeat offenders for closer inspection of 
> reports.

The CVE in question is CVE-2023-46045. MITRE still shows it as RESERVED 
but many downstream trackers already have the details.

Whether this has a security impact or not is environment specific. So 
I’m inclined to be conservative and leave it. Though the affected 
versions are wrong, which is going to impact downstream triage, so we’ll 
have to contest that.

The Graphviz project doesn’t generally request CVEs. Though sometimes 
third parties request CVEs against Graphviz. We’re usually fine with 
that; if someone wants a CVE to track, OK. These third parties rarely 
(never?) consult with us before requesting. So Graphviz commit messages 
and changelogs almost never mention CVEs, because we’re not aware of 
them at the time.