oss-security - Dealing with CVEs that apply to unspecified package versions

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <87wpbq5uqz.fsf@gnu.org>
Date: Wed, 15 Mar 2017 18:12:52 +0100
From: ludo@....org (Ludovic Courtès)
To: oss-security@...ts.openwall.com
Cc: Leo Famulari <leo@...ulari.name>
Subject: Dealing with CVEs that apply to unspecified package versions

Hello,

Some CVE entries do not specify the version of the package(s) they apply
to.  For instance, the software list for CVE-2016-10165 contains
“cpe:/a:littlecms:little_cms_color_engine”, which theoretically means
that it applies to any version of lcms.

The problem is automated tools cannot exploit such entries in practice
because they cannot tell which package versions are affected.

While tuning our CVE tracking tool in GNU Guix, we found that such
entries are not uncommon:

  https://lists.gnu.org/archive/html/guix-devel/2017-03/msg00335.html

What are the possibilities to address this issue?

I can think of two actions that could perhaps be taken:

  1. The software behind the CVE form could force submitters to specify
     version numbers.

  2. For recent entries (say, 2 years old at most), a bot could email
     the original submitters kindly asking them to provide the missing
     version info.

Thoughts?

Thanks,
Ludo’.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.