[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130429195023.GA18654@frohike.xs4all.nl>
Date: Mon, 29 Apr 2013 21:50:23 +0200
From: Peter Bex <Peter.Bex@...all.nl>
To: Open Source Security <oss-security@...ts.openwall.com>
Subject: Re: OS command injection vulnerability in Chicken Scheme
On Mon, Apr 29, 2013 at 01:33:12PM -0600, Kurt Seifried wrote:
> > The full announcement is here:
> > http://lists.nongnu.org/archive/html/chicken-announce/2013-04/msg00000.html
>
> Please use CVE-2013-2024 for this issue.
Thank you.
> > By the way, I'm confused as to why the CVEs I've requested so far
> > don't show up in NVD. For example,
> > http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6122 says
> > the CVE does not exist, but Kurt assigned it in February:
> > http://www.openwall.com/lists/oss-security/2013/02/08/2
> >
> > The other CVE numbers in that mail produce a "not found" page as
> > well and an NVD database search for "chicken" turns up nothing
> > related to Chicken Scheme. The page says the database was last
> > updated April 19th 2013, so that's not the cause either.
>
> Because Mitre has a large backlog of CVE's to research and write up.
> Submitting researched/written entries to them will probably result in
> your entries being posted faster. Try to remember that CVE pushed
> thousands of these a year, the volume is considerable.
What sort of information would they require, besides the advisory
I posted in my mail? If there's something I can do better to make
their lives easier, I will certainly consider it!
> Apologies for the late reply
No problem!
Cheers,
Peter
--
http://www.more-magic.net
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
