Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun, 4 Jan 2015 17:44:30 -0500 (EST)
From: "Steven M. Christey" <coley@...re.org>
To: oss-security@...ts.openwall.com
cc: Dan McDonald <danmcd@...iti.com>, cve-assign@...re.org
Subject: Re: CVE Request for illumos distributions


On Sat, 3 Jan 2015, Christos Zoulas wrote:

> On Jan 3,  6:57pm, cve-assign@...re.org (cve-assign@...re.org) wrote:
> -- Subject: Re: [oss-security] CVE Request for illumos distributions
>
> | > Illumos bug #5421 - http://illumos.org/issues/5421 which is now fixed in
> | > the upstream illumos-gate, is an innocuous fix to a serious problem that
> | > allows an arbitrary user in the global zone (non-global zones are not
> | > able to panic the machine) to panic the machine.
> |
> | Use CVE-2014-9491.
>
> Shouldn't we be using CVE-2015-XXXX by now?

This ID (and others) used a 2014 date because the bug report was 
technically public in 2014.  The year portion of a CVE ID typically 
reflects when the CVE was requested for non-public issues; or for 
already-public issues, the year portion typically reflects the year of 
disclosure.  The disclosure date itself can be a subject of 
interpretation, such as when an issue is disclosed at a 
publicly-accessible URL but only likely to be noticed by a limited 
audience ("technically public") versus when the issue becomes "widely 
public" to the infosec industry.

Especially in the transition from the end of one year to the beginning of 
the next year, there can be a mixture of dates.  Also, CVE (and every 
other vulnerability "database" or repository) frequently add entries for 
earlier years.  Accordingly, there is still a chance that CVE-2014-xxxx 
IDs will reach 5 digits, either in 2015 or later, as we continue to cover 
older issues that we discover or did not prioritize in earlier years.

- Steve

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.