[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20200214095455.GA579322@espresso.pseudorandom.co.uk>
Date: Fri, 14 Feb 2020 09:54:55 +0000
From: Simon McVittie <smcv@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE for program distributing vulnerable
components ?
On Fri, 14 Feb 2020 at 00:11:00 +0100, security minded wrote:
> I've identified a program whose installer contains components with known
> CVEs. Should one or several CVE be asked for the installer itself ?
The CVE IDs for the individual vulnerable components are enough to
describe the vulnerability. You don't need new CVE IDs to describe the
fact that the installer installs vulnerable components.
Linux distribution packages are like installers, if you think about
it - and when a security vulnerability like CVE-2018-16428 is reported
in an upstream project like GLib, the same CVE ID is used to represent
the vulnerability in unfixed versions of the upstream project, unfixed
Debian packages, unfixed Fedora packages and so on. We say something like
"Debian 9's glib2.0 package is vulnerable to CVE-2018-16428". Otherwise
we'd need many more CVE IDs than we do now.
smcv
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
