Date: Tue, 29 Jul 2014 22:14:37 +0200 From: Tomas Hoger <thoger@...hat.com> To: Ritwik Ghoshal <ritwik.ghoshal@...cle.com> Cc: oss-security@...ts.openwall.com Subject: Re: Additional information on CVE-2014-2469? On Mon, 21 Jul 2014 11:19:21 -0700 Ritwik Ghoshal wrote: > > Is there anyone from Oracle on the list? Does anyone have further > > information on CVE-2014-2469? > > https://blogs.oracle.com/sunsecurity/entry/cve_2014_2469_denial_of > > As far as we know CVE-2014-2469 affects lighttpd in Solaris only. I > have fixed the typo in our advisory. Thank you for pointing it out. Is there a good reason to not provide any actionable details? Flaw details and/or patch link (I'm assuming this got corrected upstream too). It's not uncommon for vendors fixing a vendor-specific issue to send a heads-up here and to upstream rather than letting everyone else using affected component to struggle trying to find any details. In this case, you don't even seem to know if it actually was vendor specific. Can Oracle ensure that actionable details are provided for any Oracle assigned CVEs for open-source components? Regardless of who the upstream is. MySQL is a good example - there were previous requests to provide at least minimal details to unambiguously map assigned CVEs to specific issues, all refused or ignored. This is a good place to share such information. -- Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ