[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20140729221437.3a1f69ac@redhat.com>
Date: Tue, 29 Jul 2014 22:14:37 +0200
From: Tomas Hoger <thoger@...hat.com>
To: Ritwik Ghoshal <ritwik.ghoshal@...cle.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: Additional information on CVE-2014-2469?
On Mon, 21 Jul 2014 11:19:21 -0700 Ritwik Ghoshal wrote:
> > Is there anyone from Oracle on the list? Does anyone have further
> > information on CVE-2014-2469?
> > https://blogs.oracle.com/sunsecurity/entry/cve_2014_2469_denial_of
>
> As far as we know CVE-2014-2469 affects lighttpd in Solaris only. I
> have fixed the typo in our advisory. Thank you for pointing it out.
Is there a good reason to not provide any actionable details? Flaw
details and/or patch link (I'm assuming this got corrected upstream
too). It's not uncommon for vendors fixing a vendor-specific issue to
send a heads-up here and to upstream rather than letting everyone else
using affected component to struggle trying to find any details. In
this case, you don't even seem to know if it actually was vendor
specific.
Can Oracle ensure that actionable details are provided for any Oracle
assigned CVEs for open-source components? Regardless of who the
upstream is. MySQL is a good example - there were previous requests to
provide at least minimal details to unambiguously map assigned CVEs to
specific issues, all refused or ignored. This is a good place to share
such information.
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
