Date: Sun, 16 Jul 2017 15:01:39 +0300 From: Henri Salo <henri@...v.fi> To: kurt@...fried.org Cc: oss-security@...ts.openwall.com, mattd@...fuzz.com Subject: ATutor CVE-2017-1000002, CVE-2017-1000003, CVE-2017-1000004 Hello Kurt, You have assigned CVE-2017-1000002, CVE-2017-1000003 and CVE-2017-1000004 (URLs below) for ATutor vulnerabilities. Why doesn't the CVE data have information of the fixed in version even it's clearly available in the reference data, which refers to URL showing that the vulnerabilities are fixed in 2.2.2 version? Isn't it supposed to be available in CVE database? I'm just trying to understand how DWF works, because it's not very clear to me. How long it usually takes that DWF assigned CVEs end up being added to MITRE and NVD databases? I can't actually see contents of upstream bug report even I registered user-account: http://www.atutor.ca/atutor/mantis/view.php?id=5681 Is this assigment somehow related to this oss-security post? http://www.openwall.com/lists/oss-security/2016/07/01/3 This has also been pending for over a year. Is this related to these new assigments or does this still need new CVE? https://www.htbridge.com/advisory/HTB23297 Also I noticed following text in the DWF-CVE-Database README.md: "Please note that some of the data from 2015 and 2016 needs to be brought up to date to the current JSON v.4 format, if you'd like to do this please do so and submit a pull request." isn't this something that should be done by DWF maintainers and maybe the CVE mentors and not wait pull requests? https://raw.githubusercontent.com/distributedweaknessfiling/DWF-CVE-Database/master/2017/1000xxx/CVE-2017-1000002.json https://raw.githubusercontent.com/distributedweaknessfiling/DWF-CVE-Database/master/2017/1000xxx/CVE-2017-1000003.json https://raw.githubusercontent.com/distributedweaknessfiling/DWF-CVE-Database/master/2017/1000xxx/CVE-2017-1000004.json -- Henri Salo
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ