Date: Tue, 05 Mar 2013 11:20:44 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Raphael Geissert <geissert@...ian.org> Subject: Re: CVE id request: busybox -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 03/05/2013 06:30 AM, Raphael Geissert wrote: > Hi Kurt, > > On 4 March 2013 03:26, Kurt Seifried <kseifried@...hat.com> wrote: > [...] >> I didn't say I;'m excluding them. I simply will require an >> original source, in this case the year is probably wrong. > > Not bikeshedding here, but sometimes those bug reports *are* the > original source. And with all due respect, it has happened before > that you've asked for an "original source" (upstream commit or bug > report) when there exists none. All it has lead is to the CVE > request becoming stalled or even abandoned. Then say so. Basically I don't want people making lazy requests and forcing me to do the basic research. > What can we do about it? > > We already have a quite long list of issues without a CVE id and > this is not good for anybody: > https://security-tracker.debian.org/tracker/data/fake-names So research them and post the requests here, problem solved! It's not like I'm unwilling to give out CVEs or something. I simply can't spend an hour researching each one. > (nb. some of the issues in the list might already have an id but > the temporary entry hasn't been removed or it was decided that no > id should be assigned) And that's why I'm not going to deal with them myself, it would eat up all my time. I need some help here in other words. > Regards, - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBAgAGBQJRNjd8AAoJEBYNRVNeJnmTVGYQAKFMMAYOE7ruEg1stN7tzAQs 7tDDLCam7a8j2AHGBVogmI4I6ADfRwcqwjNBv7DOv63AQZbkw+OiVGbPADMGlKDP 8ZIdiwZvt2Z6OBprH6k0vVMGpSF9aQcirDF0qdXplGjo8sxiyXG8S8YZy0/b/y7Q QJo5qezE5+5djiG9EGNQi97VnARo514eZGLqdo8kWE2FHV+js64oSkUcH5Veu02C NAQRQziKZNpWf3ZCVZ4ByOEigbSuy8198lFqCjB3XoXrEIYk+eT2g1Fx41KdToQk ZLQ5mfAqWN/9wMLBRPRcMnojNFMHaOhCZ1AULcQyAsngu36hmvAPwFidVsDJTBwG M9UANh5Lq9Mkwu4zqF43/v3raen2Y1vQcFa7YBneHoXxtZQEDFHhK+QiZFHhLaMe TBmiuzu+N+WAhPtrGYd23BQRrOytepuFzjG2NFbxYiao8fYgFZ0rB+4Yn/W9b7t/ kCmfJttKVPwgtoS6+Oj4a/FrgVhMiWrcjonv6njxleiWvS6gsziChp4+pp+grEr3 ygFgogDtJgC2/yKlwV/ycz4rG2iiAHqkHXmebn21Nwfsxr3WnaVYQd8sJ3eOyczI pi49oU1L98678JlopgvifZhut803cqIH5sFT8hZvNIgVPH+eUfqvAGH1tI2q8ewN eA3Gc1vXdzMF19rRFlEL =b60Q -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.