Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 1 Feb 2024 21:54:05 +1300
From: Amos Jeffries <>
 Matthew Fernandez <>
Subject: Re: Numerous unconfirmed FOSS CVEs disclosed on FD
 mailing list

On 27/01/24 12:03, Matthew Fernandez wrote:
> On 1/27/24 08:53, Alan Coopersmith wrote:
>> While I can't speak for all the projects involved, I can speak for the
>> X.Org maintainers & security team, and I can say that we were not
>> consulted or informed about this CVE filing - if I wasn't on the FD
>> mailing list, I wouldn't even know it had happened.  The CNA responsible
>> has not yet published the CVE to the CVE database yet, so we can't yet
>> file a dispute, but once they do, I plan to request that they withdraw
>> CVE-2023-45916 for xedit, as there is no security boundary crossed here
>> and the bug doesn't allow someone to do anything they otherwise couldn't.
> We (the Graphviz maintainers) were also not consulted/informed. Though 
> we do not plan to contest the CVE.

Please *DO* contest CVE issued for non-security bugs. It helps 
discourage this kind of bad behaviour if their CVEs get removed. May 
also help CNA to identify repeat offenders for closer inspection of reports.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.