[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 29 Apr 2013 21:18:00 +0000
From: "Christey, Steven M." <coley@...re.org>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: RE: OS command injection vulnerability in Chicken
Scheme
Despite popular perception, the presence of useful details does not necessarily get CVEs published more quickly (although missing or conflicting details certainly make things worse, and poorly-written advisories can reduce overall throughput). We have particular description styles and analytical requirements that are not visible to the general public. We have a process where we actively monitor public sources including oss-security, and we prioritize which CVE entries are published first. Priorities are currently guided by
http://cve.mitre.org/data/board/archives/2012-09/msg00000.html, but other disclosures are certainly considered as well.
We are currently focused on working with the CVE Editorial Board on extending the CVE ID syntax to handle more than 10,000 vulnerabilities per year, and we are also training several new hires. We expect our output to rise noticeably within a few months, and we will continue to refine our analysis and publication processes to improve our production in a way that balances the needs of CVE's many diverse users.
- Steve
>-----Original Message-----
>From: Peter Bex [mailto:Peter.Bex@...all.nl]
>Sent: Monday, April 29, 2013 3:50 PM
>To: Open Source Security
>Subject: Re: [oss-security] OS command injection vulnerability in Chicken
>Scheme
>
>On Mon, Apr 29, 2013 at 01:33:12PM -0600, Kurt Seifried wrote:
>> > The full announcement is here:
>> > http://lists.nongnu.org/archive/html/chicken-announce/2013-
>04/msg00000.html
>>
>> Please use CVE-2013-2024 for this issue.
>
>Thank you.
>
>> > By the way, I'm confused as to why the CVEs I've requested so far
>> > don't show up in NVD. For example,
>> > http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6122 says
>> > the CVE does not exist, but Kurt assigned it in February:
>> > http://www.openwall.com/lists/oss-security/2013/02/08/2
>> >
>> > The other CVE numbers in that mail produce a "not found" page as
>> > well and an NVD database search for "chicken" turns up nothing
>> > related to Chicken Scheme. The page says the database was last
>> > updated April 19th 2013, so that's not the cause either.
>>
>> Because Mitre has a large backlog of CVE's to research and write up.
>> Submitting researched/written entries to them will probably result in
>> your entries being posted faster. Try to remember that CVE pushed
>> thousands of these a year, the volume is considerable.
>
>What sort of information would they require, besides the advisory
>I posted in my mail? If there's something I can do better to make
>their lives easier, I will certainly consider it!
>
>> Apologies for the late reply
>
>No problem!
>
>Cheers,
>Peter
>--
>http://www.more-magic.net
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
