Date: Fri, 20 Dec 2013 10:38:11 -0500 (EST) From: cve-assign@...re.org To: jmm@...ian.org Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request: Asterisk AST-2013-007 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > But an ID is missing for > http://downloads.asterisk.org/pub/security/AST-2013-007.html It is missing because that disclosure does not qualify for a CVE ID. The rationale sent to upstream was: 'We don't think we'll be able to assign a CVE number for the downloads.asterisk.org/pub/security/AST-2013-007.html announcement. As far as we can tell, the announcement is about introducing an optional new security feature. An example of a type of issue that could have a CVE assignment is: ... a third party ships a product based on Asterisk ... this product implements an external control protocol that is capable of calling the SHELL and FILE functions with untrusted user input ... the third party publishes a security announcement stating that the new release of their product ships with a revised asterisk.conf containing a "no" value for the "live_dangerously" option, in order to fix this vulnerability ... We would generally assign one CVE number for each such security announcement, if any are found.' - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJStGRFAAoJEKllVAevmvmsT7sH/jG+t0zvQPHnDdQNWzta/dOX v+qoi1ej0V8NYNflNY5A7SPNGtCJrvsCewyYwprZ04tEiFhPV5SwgF6YbMOIGPFl 6dJA6oyu4Hyl7+28Snacesi1xh5F7oBaRA+uBdTfVeKTXC8OacfsfCQSXdjWWFbV Hi/JY4cjRJIZEQLEOGxxIka8E3nnpKhz0+CkQKqGeVAZLEN2wsiZpaYUFKtg6DIx VbDF+GoX8MNK4ueKcuDDw3CRTGbnC5mpc1zJXrvaKLQWh607VrWzxBMoIGycpGFR EhIjmKL0nD0IoplbSZrU0KDSMZSzO9ZOA10HgUncI1L5+jFRCHkQlTjtxT7yHgk= =zlC7 -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.