Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Feb 2013 17:13:06 +0100
From: Petr Matousek <>
To: Greg KH <>
Subject: Re: CVE request - Linux kernel: VFAT slab-based
 buffer overflow

On Wed, Feb 27, 2013 at 06:48:34AM -0800, Greg KH wrote:
> On Wed, Feb 27, 2013 at 07:31:30AM +0100, Petr Matousek wrote:
> > For starters, submissions should be posted to
> > oss-security or any other security related public mailing list when
> > the
> > patch is being committed.
> That's not going to happen, and you know that, to do so would be
> totally
> irresponsible of us and directly harm your users.  That's what
> vendor-sec (or whatever it is called now) is for.

linux-distros [1] is vendor-sec replacement for Linux related issues.


> Hasn't that been
> happening for a while now, or has no one been notifying that list of
> these issues?

Regrettably no. No notifications of Linux kernel security issues
reported to mailing list to linux-distros (former
vendor-sec) are happening on regular basis. I (speaking as Red Hat
Security Response Team member in charge of kernel security issues) would
really appreciate the notifications. Even marking commits that were
committed as a result of submission as sko
originated would be really helpful.

The linux-distros/oss-sec members can make sure that each issue gets CVE
and it's properly publicly communicated at the right time (preferably
when the issue is public -- when it is committed).

Should you consider this approach, is there anything I can help with to
make that happen?

Thank you,
Petr Matousek / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.