Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAAHN_R0PrisCtNJNVfCqp3pHsqFPT+P2aRPLdcknGC9w8vOCWA@mail.gmail.com>
Date: Wed, 21 Jun 2023 13:20:37 -0400
From: Siddhesh Poyarekar <siddhesh.poyarekar@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2023-31975: memory leak in yasm

On Tue, Jun 20, 2023 at 6:49 PM Alan Coopersmith
<alan.coopersmith@...cle.com> wrote:
>
> https://nvd.nist.gov/vuln/detail/CVE-2023-31975 is freaking out scanners
> since it claims this bug has a CVSS of 9.8.
>
>  From what I see at https://github.com/yasm/yasm/issues/210 though, I can't
> see any CVSS higher than 0.0 being relevant here and think the CVE should
> be withdrawn.  Am I missing something here?  All I see is 2 objects of

I wrote a SECURITY.md[1] for yasm a while back to push back on such
bogus CVEs, so this CVE should actually get rejected.

Sid

[1] https://github.com/yasm/yasm/blob/master/SECURITY.md

-- 
https://gotplt.org

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.