Date: Mon, 13 Apr 2015 17:41:14 +0300 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Subject: discourage "CVE only" use of (linux-)distros Hi, I've just added the below paragraph: It is intended that these lists be used primarily to provide actionable information to multiple distribution vendors at once. While you may at the same time request and obtain a CVE ID for the vulnerability you report, and that's great, please avoid using these lists if your sole purpose of their use is to obtain a CVE ID (e.g., when the affected software isn't something any of the distributions currently ship, or when they are unlikely to benefit from the advance notice). In those CVE only cases, please request the CVE IDs either on the public oss-security list right away, or from MITRE directly. When you contact MITRE directly about an issue that is not yet public, please do not disclose to them more than the absolute minimum needed for them to assign a CVE ID. to http://oss-security.openwall.org/wiki/mailing-lists/distros I'd appreciate comments on this. Maybe we can clarify what MITRE's "absolute minimum" is (link to a page explaining this?) Naturally, this edit is prompted by some notifications sent to the distros list that looked like they are "CVE only", not actually benefiting the distros and thus placing the vulnerability information at unjustified risk. (Would it be any safer with MITRE, though?) My opinion is that CVEs are not that important to request them before making the issue public, unless this can easily be done without placing the vulnerability information at extra risk - e.g., if it's actionable for (linux-)distros anyway, and the CVE ID assignment can happen as a nice extra there, or if MITRE can assign them without obtaining detail. Another aspect is that, if I understood correctly, MITRE is currently slow at CVE ID assignments, and distros is way quicker. This may be driving CVE requests to distros, too. More importantly, a concern is that slow CVE ID allocation by MITRE might delay public disclosure of issues by those reporters who really want to have CVE IDs on their advisories, etc. I think they should not actually delay anything for that minor reason alone, but that's just me. The reality might be that they do delay. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ