[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <72ad0aa8-88c8-cba1-84d4-35cc69fc86af@treenet.co.nz>
Date: Fri, 10 Feb 2017 08:23:18 +1300
From: Amos Jeffries <squid3@...enet.co.nz>
To: oss-security@...ts.openwall.com
Subject: Re: MITRE is adding data intake to its CVE ID process
On 10/02/2017 5:07 a.m., Steven R. Loomis wrote:
> On 2/9/17 6:54 AM, Peter Bex wrote:
>> In an ideal world, free software project leaders should be
>> able to request a CVE ID _before_ announcing a vulnerability to their
>> user base. If there were some way to register people as project leaders,
>> the "proof" should not be necessary, they should be able to request a
>> CVE ID with authority.
> Peter,
> I actually wondered about this very thing, if it was possible to
> request an ID before the details were fully available. From your note,
> it sounds like this is not the case currently.
>
> Steven
>
I used to request CVE with a brief description suitable for the CVE
record and reference URL(s) eg. where the upstream advisory was going to
be located. Nowdays someone at mitre seems to be waiting for the URL to
go public before assignment :-(.
AYJ
Download attachment "signature.asc" of type "application/pgp-signature" (835 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
