[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20141209020231.GA27212@openwall.com>
Date: Tue, 9 Dec 2014 05:02:31 +0300
From: Solar Designer <solar@...nwall.com>
To: David Cramer <david@...sentry.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE Request
On Mon, Dec 08, 2014 at 03:28:12PM -0800, David Cramer wrote:
> (Pardon my complete lack of any clue how this process works)
>
> Now seems like a good time to formalize our internal policy of how we do security releases, and while we might have already butchered this one, it was suggested we attempt to get a CVE assigned.
>
> Software name and optionally vendor name
> raven-ruby (part of Sentry)
>
> Type of vulnerability
> DoS
I expect someone else will get back to you regarding the CVE request,
but I'd like to ask that we please always include the affected software
name and usually also the vulnerability type in the Subject line of
messages posted in here. Many of us don't care about CVEs much, but
would like to notice information about vulnerabilities possibly relevant
to us. Also, having two or more mere "CVE Request" threads on the list
almost at once is confusing. A better Subject line would have been e.g.
"CVE Request - raven-ruby (part of Sentry) DoS". Thanks!
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
