Date: Wed, 15 Mar 2017 18:12:52 +0100 From: ludo@....org (Ludovic Courtès) To: oss-security@...ts.openwall.com Cc: Leo Famulari <leo@...ulari.name> Subject: Dealing with CVEs that apply to unspecified package versions Hello, Some CVE entries do not specify the version of the package(s) they apply to. For instance, the software list for CVE-2016-10165 contains “cpe:/a:littlecms:little_cms_color_engine”, which theoretically means that it applies to any version of lcms. The problem is automated tools cannot exploit such entries in practice because they cannot tell which package versions are affected. While tuning our CVE tracking tool in GNU Guix, we found that such entries are not uncommon: https://lists.gnu.org/archive/html/guix-devel/2017-03/msg00335.html What are the possibilities to address this issue? I can think of two actions that could perhaps be taken: 1. The software behind the CVE form could force submitters to specify version numbers. 2. For recent entries (say, 2 years old at most), a bot could email the original submitters kindly asking them to provide the missing version info. Thoughts? Thanks, Ludo’.
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.