Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 24 Mar 2015 12:21:52 +0000
From: Jeremy Stanley <>
Subject: Re: Re: CVE request for OpenStack Compute (nova)

On 2015-03-24 03:36:10 -0400 (-0400), wrote:
> So, does the OpenStack VMT have a position on whether to choose this
> latter scenario? In other words, if live migration fails because of a
> disconnected physical network interface, is access control for volumes
> intentionally undefined afterward?

As a member of the OpenStack VMT, I have no opinion on this. We
don't generally express an opinion on whether a bug report _can_
have an associated CVE, only on whether the bug is associated with
an attack scenario we deem likely enough to warrant the effort
expended in discussing and fixing it under embargo, backporting to
supported stable branches, then creating and publishing a formal
security advisory. Of the many reports we initially receive as
potential vulnerabilities, only a fraction actually end in an
advisory as opposed to being considered a security hardening
Jeremy Stanley

Download attachment "signature.asc" of type "application/pgp-signature" (950 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.