Date: Mon, 13 Nov 2017 10:07:00 -0500 (EST) From: Vladis Dronov <vdronov@...hat.com> To: oss-security@...ts.openwall.com, Greg KH <greg@...ah.com> Subject: Re: CVE-2017-15102: Linux kernel: usb: NULL-deref due to a race condition in [legousbtower] driver Hello, Greg, all, My fault here was indeed not stating that a Red Hat's product is vulnerable (thus, a CVE was assigned), but stating that only Linux kernel is vulnerable (while indeed it was fixed a long ago). Please, accept my apologies. > I hate to ask, but why are you getting CVEs for bugs fixed over a year > ago, and are already in all stable kernel releases a year ago? Why does > it matter? I'm afraid, you won't like the answer, but in a short word, the Red Hat is a CNA (CVE Numbering Authority) for Red Hat's products and the Linux kernel and we've decided to assign this CVE. Best regards, Vladis Dronov | Red Hat, Inc. | Product Security Engineer
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.