[<prev] [<thread-prev] [day] [month] [year] [list]
Message-ID: <aERVrO2dSuY-S9OY@lappy>
Date: Sat, 7 Jun 2025 11:07:24 -0400
From: Sasha Levin <sashal@...nel.org>
To: Bastian Blank <bblank@...nkmo.de>, oss-security@...ts.openwall.com
Subject: Re: Re: Re: Linux kernel: HFS+ filesystem
implementation, issues, exposure in distros
On Sat, Jun 07, 2025 at 04:53:07PM +0200, Bastian Blank wrote:
>On Sat, Jun 07, 2025 at 10:37:12AM -0400, Sasha Levin wrote:
>> The scope, which I assume was quoted from
>> https://www.cve.org/PartnerInformation/ListofPartners/partner/Linux also
>> lists cve@...nel.org as the right email to contact.
>
>This page also links as step one to
>https://www.kernel.org/doc/html/latest/process/security-bugs.html, which
>does _not_ list cve@...nel.org anywhere.
Hrm... Have you read through the doc?
>> Note that this isn't just a technicality: for example, I'm a member of
>> cve@k.o, but *NOT* of security@....
>
>But it already reached the right organisation. Did security@k.o respond
>with a referal?
security-bugs.html which you've linked contains information about the
CVE process and answers your question:
CVE assignment
The security team does not assign CVEs, nor do we require them
for reports or fixes, as this can needlessly complicate the
process and may delay the bug handling. If a reporter wishes to
have a CVE identifier assigned for a confirmed issue, they can
contact the kernel CVE assignment[1] team to obtain one.
[1] https://www.kernel.org/doc/html/latest/process/cve.html
--
Thanks,
Sasha
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
