[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 15 Jun 2019 11:21:41 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security@...ts.openwall.com
Subject: Re: Thousands of vulnerabilities, almost no CVEs:
OSS-Fuzz
On Sat, 15 Jun 2019, Alex Gaynor wrote:
>
> Today I'd like to highlight what I see as a tremendous issue: very few of
> these security bugs ever has a CVE issued for it. This is probably due to a
> few factors, a) the relative difficulty of obtaining a CVE, b) the lack of
> a human reporter who is interested in obtaining one for "credit" purposes,
> c) the sheer number of bugs that we're talking about.
Many oss-fuzz "security" issues are not CVE-worthy although they are
bugs worthy to spend time fixing.
At least as pertains to the Debian project, I do feel that someone is
looking at each security issue I fix and creating CVEs for serious
issues. A CVE summary page for GraphicsMagick is maintained at
https://security-tracker.debian.org/tracker/source-package/graphicsmagick.
> This is in addition to the >100 security bugs OSS-Fuzz found and publicly
> disclosed due to hitting their disclosure deadline, and which still have
> not been fixed [3].
Security bugs are often very hard to diagnose and fix. The community
has become much better at producing bug reports than with helping to
solve the problems found. Help with actually fixing issues is
appreciated. I think that the objective should be open source
software which lacks bugs and still provides a useful purpose.
Finding bugs is just part of the effort.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Public Key, http://www.simplesystems.org/users/bfriesen/public-key.txt
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
