[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170522185720.GA13059@suse.de>
Date: Mon, 22 May 2017 20:57:21 +0200
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: How to request a CVE for open source projects
Hi,
You can request CVEs for opensource projects via the Mitre webform.
For e.g. the Linux Kernel I just used "Linux" as vendor, for Xen "Xen" and similar.
(and in general:)
Please everyone do the distributors a favour and link to GIT commits with fixes for
the requested CVE or at least explicit single reproducers, as we have increasing trouble
of associating CVEs with the correct place in code.
Ciao, Marcus
On Mon, May 22, 2017 at 01:05:34PM -0500, Michael Catanzaro wrote:
> Hi,
>
> I'm aware that the CVE form [1] can now be used to request CVEs. However, it
> does not seem to be designed for requesting CVEs in open source products.
> The field "Vendor of the product(s)" says "Please ensure vendors are on the
> products and sources list," indicating the intent of MITRE to restrict usage
> of the form to specific products. This list [2] says "For open source
> software products not listed below, request a CVE ID through the Distributed
> Weakness Filing Project CNA." So, clearly we are supposed to request a CVE
> through the DWF project. (Or perhaps via Red Hat, since it seems like it's
> willing to allocate CVEs for miscellaneous Linux-related issues.)
>
> Anyway, I attempted to request a CVE using the DWF project's request form
> [3] several months ago, but have not yet received any response [4]. So I am
> hesitant to request further CVEs from the DWF project, for fear that I won't
> receive a response and will wind up needing to make a duplicate CVE request
> somewhere else.
>
> How are other people getting open source CVEs right now? Has anybody else
> had luck getting a CVE via DWF? Should I be trying to do this through Red
> Hat instead? Or just by filling out MITRE's CVE form even though we're not
> really supposed to be using it?
>
> Michael
>
> [1] https://cveform.mitre.org/
> [2] http://cve.mitre.org/cve/request_id.html#cna_coverage
> [3] http://iwantacve.org/
> [4] https://bugzilla.gnome.org/show_bug.cgi?id=752738#c15
>
--
Marcus Meissner,SUSE LINUX GmbH; Maxfeldstrasse 5; D-90409 Nuernberg; Zi. 3.1-33,+49-911-740 53-432,,serv=loki,mail=wotan,type=real <meissner@...e.de>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
