Date: Mon, 25 Sep 2017 19:41:20 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security <oss-security@...ts.openwall.com> Subject: Re: Linux kernel CVEs not mentioned on oss-security On Mon, Sep 25, 2017 at 3:50 PM, Priedhorsky, Reid <reidpr@...l.gov> wrote: > > > My questions: > > 1. Is oss-security’s coverage of security issues in open-source software > intended to be comprehensive? If so, this appears not to be true for the > Linux kernel. > Nope. To quote the web site: 'Open Source software security discussions " http://www.openwall.com/lists/ the fact that it has turned into a security announce list with limited discussion is just how things go I guess. Also it's tough because the Linux Kernel has explicitly said they won't get CVE's for all their security issues, they simply fix and move on, their culture is "run something current, if not, to bad" (which part of me agrees with, but that doesn't work so well for IoT/enterprise/people needing a high degree of stability/assurance). > > 2. Is there another source of comprehensive coverage of vulnerabilities in > the Linux kernel, including but not necessarily limited to all CVEs issued > for it? > There are commercial security information vendors that claim to provide this, I won't name names as I don't know how good they are. Step 1 here for the open source community would be making sure Kernel issues get CVEs, and then that those CVEs get into the CVE database so people are aware of them. > > I appreciate everyone’s time and effort on all this stuff. This post > should not be interpreted as singling out Debian for criticism. > > Thanks, > Reid -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ