[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20150219040341.7295FB2E162@smtpvbsrv1.mitre.org>
Date: Wed, 18 Feb 2015 23:03:41 -0500 (EST)
From: cve-assign@...re.org
To: kseifried@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, security@...ebsd.org
Subject: Re: FreeBSD: URGENT: RNG broken for last 4 months
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> If you are running a current kernel r273872 or later, please upgrade
Our perspective at this point is that FreeBSD-CURRENT is not a
"software product" and typically should not have CVE assignments. If
anyone on the FreeBSD Security Officer Team believes that this, for
whatever reason, is a case where FreeBSD-CURRENT should have a CVE, we
are willing to go with their preference.
> quite a few people run -current (and it's a 4 month affected window),
> so if we're assigning CVE's to stuff hosted in github, then it seems
> fair
A project on github can be a software product if the developers choose
to use github that way. FreeBSD-CURRENT is, for example, advertised as
"any given commit is just as likely to introduce new bugs as to fix
existing ones"
(https://www.freebsd.org/doc/en/books/handbook/current-stable.html).
The defined use cases for FreeBSD-CURRENT don't suggest that it has
any expected behavior, security-wise or otherwise: it is just a point
in the development process. Also, we don't happen to know of
situations where third parties repackage and support FreeBSD-CURRENT
code (e.g., as the embedded OS of an appliance).
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJU5V/UAAoJEKllVAevmvmswX0IAJvlnDzjyPxNgRbkZbMkqBlP
jWu4RE4wKDIdNbMWKkPofiS0CjxT1JUvdjWJccUuEFvGMusGQcPahbIlkWUMvnRw
fzJz+y8ge2Va7VrFoy+MzP083d3X1/oUeSf/MF4UjruoUhu1LFrTKRvHZhjuVJDn
/VXmbtScI3V8zNPkmOcepdhau6AWzXi1kZ0jvTcAPtobkXc/MUCOkr2hca5iACDL
zLr/H3rzRxBMqGLXW4YqvWWRTBZc5+l3w6RGuiY5oJWkigs8UTNyKurovsw/zGZ9
lpflDjdBbSKaFvycWNOJLj9A0bTD7jo1M/6EUdzvIzBGlVnbSrlCiFfES5jpmXI=
=6XgW
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
