[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <6c663f3b-985d-083e-8b00-d428e34b2e29@redhat.com>
Date: Mon, 22 May 2017 18:53:42 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: How to request a CVE for open source projects
On 2017-05-22 5:44 PM, Kurt H Maier wrote:
> On Mon, May 22, 2017 at 03:13:42PM -0600, Kurt Seifried wrote:
>> Well actually they can. Why do you think we (DWF) have an extensible Json format with the data hosted in git? Hint: so people can contribute.
> Is it the opaque Google Docs form that fosters contribution, or the
> gatekept pull-request process requiring a Github account that fosters
> contribution?
Neither, that's part of what I'm figuring out. Most likely it'll look
like a trusted pool of people (aka CVE Mentors) that can either
contribute or more easily gatekeep). Also the doc are out of date and
the process is evolving rapidly so I haven't really bothered updating
them since things keep changing.
> At what point in the DWF process is third-party input expected to occur?
Good question. What exactly is it you want to input? CVE requests? CVE
assignments? Modify existing CVE entries?
> The matter is not addressed in the documentation repository. Feel free
> to mail me offlist if the answers would induce excessive cognitive
> dissonance.
Not really. the docs are out of date and I'm more concerned about
evolving this right now then updating documentation.
>
> khm
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
