[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20150324122152.GN2457@openstack.org>
Date: Tue, 24 Mar 2015 12:21:52 +0000
From: Jeremy Stanley <jeremy@...nstack.org>
To: oss-security@...ts.openwall.com, cve-assign@...re.org
Subject: Re: Re: CVE request for OpenStack Compute (nova)
On 2015-03-24 03:36:10 -0400 (-0400), cve-assign@...re.org wrote:
[...]
> So, does the OpenStack VMT have a position on whether to choose this
> latter scenario? In other words, if live migration fails because of a
> disconnected physical network interface, is access control for volumes
> intentionally undefined afterward?
As a member of the OpenStack VMT, I have no opinion on this. We
don't generally express an opinion on whether a bug report _can_
have an associated CVE, only on whether the bug is associated with
an attack scenario we deem likely enough to warrant the effort
expended in discussing and fixing it under embargo, backporting to
supported stable branches, then creating and publishing a formal
security advisory. Of the many reports we initially receive as
potential vulnerabilities, only a fraction actually end in an
advisory as opposed to being considered a security hardening
opportunity.
--
Jeremy Stanley
Download attachment "signature.asc" of type "application/pgp-signature" (950 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
