Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 2 Feb 2013 16:15:21 +0200
From: Henri Salo <>
Subject: Re: A small backlog of vulnerabilities in Chicken

On Sat, Feb 02, 2013 at 02:59:03PM +0100, Peter Bex wrote:
> Recently a handful of security bugs have been found and fixed in the
> Chicken Scheme compiler (  We (the core team)
> have decided we'd like to start using CVE identifiers for the benefit
> of our users and distributions.


> I'd also like to know if it's possible to get CVE numbers assigned
> *before* issuing a security advisory, but without immediate full
> disclosure, so an initial advisory can be complete with CVE number.
> The CVE can be updated afterwards with the link to the advisory when
> it is issued.  This should make it easier for users to find information
> about the bug.  This list's Openwall wiki seems to imply that it's
> only possible to request a CVE for an issue given all the information
> immediately, but a recent message from Kurt Seifried in a thread about
> Jenkins says that it can be done.  If it's indeed okay to e-mail Kurt
> directly, it would be helpful to include this in the documentation wiki.

Henri Salo

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.