[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 20 Dec 2013 16:28:03 +0100
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Cc: cve-assign@...re.org
Subject: Re: CVE already assigned for 1026891?
On Wed, Dec 18, 2013 at 12:58:17PM -0700, Vincent Danen wrote:
>
> On Dec 18, 2013, at 12:43 PM, cve-assign@...re.org wrote:
>
> > Signed PGP part
> > http://www.openwall.com/lists/oss-security/2013/12/18/3 raises the
> > question of whether there is a CVE assignment in
> > https://bugzilla.redhat.com/show_bug.cgi?id=1026891 already, in order
> > to avoid a duplicate assignment. Our guess is that security issues
> > tracked privately by Red Hat typically do have pre-assigned CVE IDs,
> > so MITRE will delay a CVE assignment indefinitely.
> >
> > Although it would be great to know what CVE ID you have assigned,
> > replying with something like "yes, it has a CVE ID, but it's only
> > being shared with the embargo audience" would be quite useful as well.
>
> There is a CVE assigned to this, but based on what Sebastian wrote, I can’t tell if it’s the same issue so I’m hesitant to say what the CVE is in case it does end up being different.
>
> Sebastian, can you give me access to your bug? Or did you intend to make it public? I’m assuming that since you are asking about a CVE here, you maybe did not mean to keep it private? Your other message said your bug contained upstream URLs (so maybe even pasting those here would be helpful).
>
> Once I can look at it, I can let you know for sure whether or not it is the same issue (and should then use the same CVE).
I have moved the bug to our Security Incidents product, so it should be visible now.
Ciao, Marcus
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
