|
Message-ID: <4F4D54D3.3020606@redhat.com> Date: Tue, 28 Feb 2012 15:27:31 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: cve-assign@...re.org Subject: Re: Re: CVE Status Clarification / Request -- kadu: Stored XSS by parsing contact's status and sms messages in history On 02/28/2012 12:18 PM, cve-assign@...re.org wrote: >> Argh sorry cut and paste the wrong CVE # into novell's bugzilla. >> Can we just remove it from there please? > > Removing Comment 4 from > https://bugzilla.novell.com/show_bug.cgi?id=749036 is definitely a > good idea, but MITRE will also do a REJECT of the CVE-2006-7248 > identifier to address the issue more completely. > > We often see vendors of CVE compatible products and services > picking up new CVE mappings from oss-security postings, and from > references cited in oss-security postings, and this often happens > on the day of the posting. Some vendors primarily just want the > mapping, and aren't really investigating the issues or possible > discrepancies. So, here, it's plausible that: Yeah, speaking as someone who did that for 9.5 years (and sent you cve dupes and errors I found =) my only comment would be people who automatically consume CVE with no checks and balances are going to have problems regardless (people make typos, systems do strange things, etc.). -- Kurt Seifried Red Hat Security Response Team (SRT)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.