Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 11 Feb 2017 09:20:55 -0600 (CST)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: MITRE is adding data intake to its CVE ID
 process

On Sat, 11 Feb 2017, Moritz Muehlenhoff wrote:
>
> Having CVEs assigned is of lesser importance, this was never primarily
> why we posted security vulnerabilities here. Obtaining CVE IDs caused
> little overhead on our side, but if that changes (and the announced
> changes sound like that), then there will simply be less CVE coverage
> I'm afraid.

In my perhaps limited experience, Debian package maintainers do not 
take action to correct a security issue in stable distributions unless 
a CVE is assigned.  They do not usually act merely based on the 
upstream package developer/maintainer reporting that they discovered 
and fixed a security issue.  If it is more challenging to get a CVE 
assigned, then many more security issues in stable distributions will 
remain unfixed.

Bob
-- 
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.