Date: Sat, 8 Aug 2020 10:49:14 +0200 From: Richard Hartmann <richih.mailinglist@...il.com> To: oss-security@...ts.openwall.com Cc: prometheus-team@...glegroups.com, Prometheus Developers <prometheus-developers@...glegroups.com> Subject: Voiding CVE-2020-16248 Dear all, the Prometheus project has received a public "vulnerability" report against what the reporter called SSRF, but what is the core functionality of blackbox_exporter: The ability to trigger network probes over the network to monitor a target's availability. The reporter stated that CVE-2020-16248 has been assigned. From context, it seems to be a paid assessment of our software for an unnamed client which increases motivation to get "results", in particular CVEs for "zero days" - which are then promptly reported publicly with an embargoed CVE. The reporter has not replied to our statement that this behaviour is core functionality. I could not find out which organization has reserved CVE-2020-16248 so I decided to send email to this list to inform the organization, enabling them to update their records. Sorry for using this list for that purpose, I could not find a less wrong place to inform the (hopefully) interested parties. Best, Richard  https://prometheus.io/  https://github.com/prometheus/blackbox_exporter/issues/669  https://github.com/prometheus/blackbox_exporter
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.