[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <b72f8f12-623a-4fc5-a7b6-001fa85d965c@protonmail.com>
Date: Tue, 04 Nov 2025 17:59:26 +0000
From: Art Manion <zmanion@...tonmail.com>
To: oss-security@...ts.openwall.com
Subject: Re: Questionable CVE's reported against dnsmasq
On 2025-11-04 04:03, Olle E. Johansson wrote:
>> On 3 Nov 2025, at 19:07, Art Manion <zmanion@...tonmail.com> wrote:
>>>> CVEs against dnsmasq (CVE-2025-12198, CVE-2025-12199, CVE-2025-12200)
>>>> and Kamailio (CVE-2025-12204, CVE-2025-12205, CVE-2025-12206, and
>>>> CVE-2025-12207) mentioned in this thread are not yet disputed and have
>>>> no comments of this sort in their descriptions.
>>
>> I asked VulDB to mark the dnsmasq CVE IDs as disputed.
The VulDB CNA decided to reject the dnsmasq CVE IDs.
>>> As part of the Kamailio project I can say that we did just become aware
>>> of these CVEs in your email. They do not make sense. Trying to get to
>>> the report, the config files used to provoke the issue can’t be downloaded.
> We’ve gone back and this was our core developer’s reaction to the mail we got earlier to our security address:
>
> "This is clearly spam, imo: vague/generic reporting, no explicit naming
> of Kamailio ... the email was not sent from the vuldb.com server
> but from mc20a2201.dnh.net ([185.46.57.114]) -- I would suggest to not
> clink on the links, they might lead to malware, etc...
I understand both sides of this problem. Would it have helped if the VulDB
notification included details such as these (from CVE-2025-12207)?
https://shimo.im/docs/vVqRMVMlrycMO63y/read
- Art
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
