[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 26 Sep 2017 14:03:30 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: Agostino Sarubbo <ago@...too.org>
Cc: oss-security <oss-security@...ts.openwall.com>
Subject: Re: Linux kernel CVEs not mentioned on oss-security
If you see this: PLEASE SUBMIT THE URL AS AN UPDATE TO THE CVE USING THE
CVE FORM (yes, I am shouting).
https://cveform.mitre.org
Choose "Request an update to an existing CVE entry" and then for "Type of
update requested" choose "Update References" and then eneter the CVE #, the
ifo and URL and hit "Submit Request"
TL;DR: Everyone wants the cat to wear a bell, and in past I'll admit we
(the CVE community) didn't make it easy to contribute. Well now we have
made it easy to contribute, so please do.
On Tue, Sep 26, 2017 at 1:07 PM, Agostino Sarubbo <ago@...too.org> wrote:
> On martedì 26 settembre 2017 20:18:38 CEST Kurt Seifried wrote:
> > You can check the CVE Database? There is the official MITRE one:
> > cve.mitre.org and the DWF for Open Source (and yes, I lag in
> submissions to
> > MITRE) at https://github.com/distributedweaknessfiling/DWF-CVE-Database/
> in
> > both cases the CVEs will have reference link(s) that ideally point to the
> > upstream making it easy to match up.
>
> As pointed out in the past (maybe spender?) the real issue is when there
> is a
> silent fix of a vulnerability where the commit message does not clearly
> state
> about the security implication. Afaik it happens frequently.
>
> --
> Agostino Sarubbo
> Gentoo Linux Developer
>
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
