Date: Fri, 2 Jun 2017 18:17:11 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security <oss-security@...ts.openwall.com> Cc: Leo Famulari <leo@...ulari.name> Subject: Re: What happens in order to get CVE numbers You can request a CVE Identifier as soon as you can answer the following questions: 1) What software is affected? Product name? Product version? 2) What is the problem type? (in some cases we accept "unknown" but you better have a reproducer that does something nasty like crash the system or execute code) 3) A description of the issue (which includes affected software. problem type and ideally the impact) 4) A reference URL, and I know the DWF will accept URL's that don't exist yet as long as you are trustworthy (e.g. "we will post the advisory at URL X"), typically for open source something like a link to the issue or the affected code is more than sufficient. So yes, you can ask for a CVE well before you commit a fix (and in some cases before you even fully understand the issue). On Fri, Jun 2, 2017 at 10:22 AM, Qhdwns123 <qhdwns123@...tonmail.com> wrote: > The developer has not yet patched it. > > Can I request CVE before committing? > > -------- Original Message -------- > Subject: Re: [oss-security] What happens in order to get CVE numbers > Local Time: June 3, 2017 12:41 AM > UTC Time: June 2, 2017 3:41 PM > From: leo@...ulari.name > To: Qhdwns123 <qhdwns123@...tonmail.com> > oss-security@...ts.openwall.com <oss-security@...ts.openwall.com> > > On Fri, Jun 02, 2017 at 09:09:09AM -0400, Qhdwns123 wrote: > > Hi > > > > What happens in order to get CVE numbers > > In order to get a CVE assignment, you can fill out the CVE request form: > > https://cveform.mitre.org/ > -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ