Date: Mon, 02 Dec 2013 18:18:53 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com, Assign a CVE Identifier <cve-assign@...re.org> Subject: Re: Re: Xen Security Advisory 82 (CVE-2013-6885) - Guest triggerable AMD CPU erratum may cause host hang -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/02/2013 04:35 PM, cve-assign@...re.org wrote: >> This was sent by MITRE as part of the CVE assignment. It seems >> likely to us (the Xen Project security team) that the CVE >> assignment was a consequence of our embargoed predisclosure to >> xen-security-issues. > > MITRE typically does not know about multi-party embargo > arrangements affecting Linux vendors and various other vendors, and > did not know about any multi-party embargo arrangement in this > case. If anyone who is regularly involved in vulnerability > remediation affecting the open-source community asks MITRE to send > an announcement of a CVE assignment to oss-security, we send that > announcement without any investigation of disclosure restrictions. > Although it is unfortunate if such an announcement had an adverse > effect on a planned disclosure timeline, we feel that this is an > isolated case and does not mean that we need to reevaluate our > approach. Also, once an issue is mentioned on oss-security by > anyone, we consider the issue fully public and we sometimes proceed > to publish a CVE immediately. To be clear I asked Mitre for the CVE for AMD (since it's not open source software). I didn't think to tell them it was embargoed since the AMD release notes and so on were public. However in future with hardware related CVE's I'll make sure to ask Mitre to keep them private if the software side is still embargoed as appropriate. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.15 (GNU/Linux) iQIcBAEBAgAGBQJSnTF9AAoJEBYNRVNeJnmTQc0P/1KnCOkN+zJrrw8XuX+IaFnG PU8k+7H7L4gNv0Cuy2aaFZiWOaOu2BHuQ8kPNdQlcRjKxfAo6TIzxKjRHAfdjAwh RTExqkGGp1twzWeYa//509fb3qXIjZ0g0FAqkLHg/8aBds7Dpu4dpk1169LM4/jo nFIB32Izrzl+P4SO99FhiW/k3HmE7YHlqliGNNpiOGAZkCB/xouGns9z4iL90vcY BQsaqRdSTFtxc84Y8ws1lk5lxDdgAKV10/cpZZyPpJm2dk9bG+slFrJ2hL8Y+b93 2Q30LIQrx4cfF9D+djXXckuxQzP+dCfikcIKER/tWX11ZoRoDB35pT7pMPy/X6W0 jJ3ijcZqgsfH4GZnTUIjccLC2RMXEEsb2ZueTgaSJ315giLxaZFanfekA/44fds4 Wg/tlchEKiBrlKBNRTqsqrud0DAL2fQny/J8Dg2VIAqC3FQOdipaTthYkjrcofOP WWf78D95+PC4txB2kpbY05AA1eDvdtmvIeBbtDnzkG8UU+KxuYmfd3Al7J2I+AqV avavh/akdyWkCC59LiVB2aRA3J7Ovr3V2dsQkO60i52ClYR1E6d9xiKLmU6Y8kFL hpHcRqIROJvwOOUOrZGQRzFAZXmN/WKJNaN2p6vo+L19u/Rsf838pSsa6NDUblq/ Ca30JT72lmgzyuq/qgKF =ncvQ -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.