Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 15 Mar 2017 18:12:52 +0100
From: ludo@....org (Ludovic Courtès)
To: oss-security@...ts.openwall.com
Cc: Leo Famulari <leo@...ulari.name>
Subject: Dealing with CVEs that apply to unspecified package versions

Hello,

Some CVE entries do not specify the version of the package(s) they apply
to.  For instance, the software list for CVE-2016-10165 contains
“cpe:/a:littlecms:little_cms_color_engine”, which theoretically means
that it applies to any version of lcms.

The problem is automated tools cannot exploit such entries in practice
because they cannot tell which package versions are affected.

While tuning our CVE tracking tool in GNU Guix, we found that such
entries are not uncommon:

  https://lists.gnu.org/archive/html/guix-devel/2017-03/msg00335.html

What are the possibilities to address this issue?

I can think of two actions that could perhaps be taken:

  1. The software behind the CVE form could force submitters to specify
     version numbers.

  2. For recent entries (say, 2 years old at most), a bot could email
     the original submitters kindly asking them to provide the missing
     version info.

Thoughts?

Thanks,
Ludo’.

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ