[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <Pine.LNX.4.64.1501041736390.3184@beijing.mitre.org>
Date: Sun, 4 Jan 2015 17:44:30 -0500 (EST)
From: "Steven M. Christey" <coley@...re.org>
To: oss-security@...ts.openwall.com
cc: Dan McDonald <danmcd@...iti.com>, cve-assign@...re.org
Subject: Re: CVE Request for illumos distributions
On Sat, 3 Jan 2015, Christos Zoulas wrote:
> On Jan 3, 6:57pm, cve-assign@...re.org (cve-assign@...re.org) wrote:
> -- Subject: Re: [oss-security] CVE Request for illumos distributions
>
> | > Illumos bug #5421 - http://illumos.org/issues/5421 which is now fixed in
> | > the upstream illumos-gate, is an innocuous fix to a serious problem that
> | > allows an arbitrary user in the global zone (non-global zones are not
> | > able to panic the machine) to panic the machine.
> |
> | Use CVE-2014-9491.
>
> Shouldn't we be using CVE-2015-XXXX by now?
This ID (and others) used a 2014 date because the bug report was
technically public in 2014. The year portion of a CVE ID typically
reflects when the CVE was requested for non-public issues; or for
already-public issues, the year portion typically reflects the year of
disclosure. The disclosure date itself can be a subject of
interpretation, such as when an issue is disclosed at a
publicly-accessible URL but only likely to be noticed by a limited
audience ("technically public") versus when the issue becomes "widely
public" to the infosec industry.
Especially in the transition from the end of one year to the beginning of
the next year, there can be a mixture of dates. Also, CVE (and every
other vulnerability "database" or repository) frequently add entries for
earlier years. Accordingly, there is still a chance that CVE-2014-xxxx
IDs will reach 5 digits, either in 2015 or later, as we continue to cover
older issues that we discover or did not prioritize in earlier years.
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
