[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 8 Aug 2020 10:49:14 +0200
From: Richard Hartmann <richih.mailinglist@...il.com>
To: oss-security@...ts.openwall.com
Cc: prometheus-team@...glegroups.com,
Prometheus Developers <prometheus-developers@...glegroups.com>
Subject: Voiding CVE-2020-16248
Dear all,
the Prometheus project[1] has received a public "vulnerability"
report[2] against what the reporter called SSRF, but what is the core
functionality of blackbox_exporter[3]: The ability to trigger network
probes over the network to monitor a target's availability. The
reporter stated that CVE-2020-16248 has been assigned. From context,
it seems to be a paid assessment of our software for an unnamed client
which increases motivation to get "results", in particular CVEs for
"zero days" - which are then promptly reported publicly with an
embargoed CVE.
The reporter has not replied to our statement that this behaviour is
core functionality. I could not find out which organization has
reserved CVE-2020-16248 so I decided to send email to this list to
inform the organization, enabling them to update their records.
Sorry for using this list for that purpose, I could not find a less
wrong place to inform the (hopefully) interested parties.
Best,
Richard
[1] https://prometheus.io/
[2] https://github.com/prometheus/blackbox_exporter/issues/669
[3] https://github.com/prometheus/blackbox_exporter
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
