[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 2 Feb 2013 16:15:21 +0200
From: Henri Salo <henri@...v.fi>
To: oss-security@...ts.openwall.com
Subject: Re: A small backlog of vulnerabilities in Chicken
Scheme
On Sat, Feb 02, 2013 at 02:59:03PM +0100, Peter Bex wrote:
> Recently a handful of security bugs have been found and fixed in the
> Chicken Scheme compiler (http://www.call-cc.org). We (the core team)
> have decided we'd like to start using CVE identifiers for the benefit
> of our users and distributions.
Nice!
> I'd also like to know if it's possible to get CVE numbers assigned
> *before* issuing a security advisory, but without immediate full
> disclosure, so an initial advisory can be complete with CVE number.
> The CVE can be updated afterwards with the link to the advisory when
> it is issued. This should make it easier for users to find information
> about the bug. This list's Openwall wiki seems to imply that it's
> only possible to request a CVE for an issue given all the information
> immediately, but a recent message from Kurt Seifried in a thread about
> Jenkins says that it can be done. If it's indeed okay to e-mail Kurt
> directly, it would be helpful to include this in the documentation wiki.
http://people.redhat.com/kseifrie/CVE-OpenSource-Request-HOWTO.html
--
Henri Salo
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
