[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 11 Apr 2024 17:12:37 +0800
From: Sean Whitton <spwhitton@...hitton.name>
To: Max Nikulin <manikulin@...il.com>
Cc: oss-security@...ts.openwall.com, emacs@...kages.debian.org,
emacs-devel@....org, Ihor Radchenko <yantar92@...teo.net>
Subject: Re: Is CVE-2024-30203 bogus? (Emacs)
Hello,
On Wed 10 Apr 2024 at 10:07pm +07, Max Nikulin wrote:
> On 10/04/2024 21:17, Salvatore Bonaccorso wrote:
>> On Wed, Apr 10, 2024 at 12:04:06PM +0000, Ihor Radchenko wrote:
>>>
>>> Yes, CVE-2024-30203 title is superfluous.
>>> And CVE-2024-30204 title is not accurate - it only applies to
>>> certain attachments with specific (text/x-org) mime type.
> [...]
>> If you think the CVE assignment is not valid, then you might ask for a
>> REJECT on https://cveform.mitre.org/ .
>
> Do 2 CVE numbers make sense to track fixes in Emacs and Org mode? Various
> versions of Org mode may be loaded to different versions of Emacs and both
> parties must have fixes to avoid the issue.
My understanding is that one CVE for the same vulnerability in multiple
code bases is normal.
--
Sean Whitton
Download attachment "signature.asc" of type "application/pgp-signature" (870 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
