Date: Thu, 04 Sep 2014 01:10:42 -0600 From: Kurt Seifried <kseifried@...hat.com> To: "Christey, Steven M." <coley@...re.org>, "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com> CC: Assign a CVE Identifier <cve-assign@...re.org> Subject: Re: heap overflow in procmail On 03/09/14 11:13 PM, Christey, Steven M. wrote: > Kurt, > >> So this is potentially a very bad issue, so I'm assigning a CVE, sorry >> Mitre (safe assumption: they're all tucked away in bed like normal sane >> people =). > > That's actually an unsafe assumption, which has introduced a vulnerability into your logic. There are counter-examples by two different CVE CNA team members in this thread alone. > > For additional evidence that counters your assumption, here are a handful of recent oss-security posts by cve-assign between midnight (Eastern time) and 4 AM. This list is far from complete. > http://www.openwall.com/lists/oss-security/2014/09/02/1 > http://www.openwall.com/lists/oss-security/2014/08/13/3 > http://www.openwall.com/lists/oss-security/2014/08/13/4 > http://www.openwall.com/lists/oss-security/2014/08/13/5 > http://www.openwall.com/lists/oss-security/2014/08/14/2 > http://www.openwall.com/lists/oss-security/2014/08/14/5 > http://www.openwall.com/lists/oss-security/2014/08/15/3 > > When an issue has been made widely public to the security industry, CNAs are expected to attempt to coordinate more closely with MITRE before assigning a CVE ID themselves. This helps to reduce confusion and duplicates. Anything posted to oss-security is considered "widely public." > > - Steve Sorry, it was meant tongue in cheek, the main reason I assumed Mitre was off because it came in relatively not super late in the day and no reply from Mitre when I noticed it. I also wanted to avoid the notify you guys then wait to confirm you weren't awake so I could get to bed early (cause getting to bed early worked out for me today, sigh). -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.