Date: Wed, 14 Sep 2016 17:08:31 -0600 From: Kurt Seifried <kseifried@...hat.com> To: oss-security <oss-security@...ts.openwall.com> Subject: Re: Re: ADOdb PDO driver: incorrect quoting may allow SQL injection On Wed, Sep 14, 2016 at 4:37 PM, Seth Arnold <seth.arnold@...onical.com> wrote: > On Wed, Sep 14, 2016 at 10:22:58AM -0600, Kurt Seifried wrote: > > Ideally people should get CVEs and then post to oss-security with the > > information and the CVE. A lot of people consume the list data and the > > current method means that people end up searching their DBs, making sure > > it's new, then entering it, then updating it with a CVE. If people got > CVEs > > first this would vastly simplify things. > > I don't like the idea of waiting on CVE assignment before posting > information here: > > - MITRE's team does impressive work, but some assignments take > significantly longer than others; a request here, publicly, allows users > to mitigate or fix before a number is known. > So join the DWF and help us get the OpenSource CVEs out quicker. > - In cases when there are no fixes yet, or incomplete fixes, it may not be > known how many CVEs are even needed -- making the issues widely known > earlier increases the chances of someone preparing patches, to clarify > how many issues existed. > Also solved in DWF land ( https://github.com/distributedweaknessfiling/DWF-Database), I explicitly setup the DWF up to handle this, the database explicitly supports a "REPLACED_BY" state for a CVE: REPLACED_BY A list of one or more CVE's that have replaced this entry and what the relationship is (e.g. a CVE split may break a single existing CVE into multiple CVEs). The format is RELATION:CVE, if there are multiple entries they are comma separated (the entire field is quoted). Valid relationships are currently: DUPLICATE_OF SPLIT_TO SPLIT_FROM MERGED_TO MERGED_FROM REJECT This field is only used if the CVE is split/merged/found to be a duplicate or rejected. So if we need to clean things up later, we can easily. > > - With MITRE's reduced scope of CVE coverage, there's the risk that > software that's important to list members or the wider computing public > may not get a number at all. Not getting a number assigned may give the > impression that the issue isn't important. > This is the Open Source Security List. The DWF mandate is all Open Source. So once the DWF is up and running the Venn diagram of oss-security and DWF is basically a single circle =). > > Thanks > -- -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.