[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CANO=Ty37M4dTtMHiRAJ1nbp6sz33SuCDZedY3dysg6SKOh7i5g@mail.gmail.com>
Date: Fri, 2 Jun 2017 18:17:11 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security <oss-security@...ts.openwall.com>
Cc: Leo Famulari <leo@...ulari.name>
Subject: Re: What happens in order to get CVE numbers
You can request a CVE Identifier as soon as you can answer the following
questions:
1) What software is affected? Product name? Product version?
2) What is the problem type? (in some cases we accept "unknown" but you
better have a reproducer that does something nasty like crash the system or
execute code)
3) A description of the issue (which includes affected software. problem
type and ideally the impact)
4) A reference URL, and I know the DWF will accept URL's that don't exist
yet as long as you are trustworthy (e.g. "we will post the advisory at URL
X"), typically for open source something like a link to the issue or the
affected code is more than sufficient.
So yes, you can ask for a CVE well before you commit a fix (and in some
cases before you even fully understand the issue).
On Fri, Jun 2, 2017 at 10:22 AM, Qhdwns123 <qhdwns123@...tonmail.com> wrote:
> The developer has not yet patched it.
>
> Can I request CVE before committing?
>
> -------- Original Message --------
> Subject: Re: [oss-security] What happens in order to get CVE numbers
> Local Time: June 3, 2017 12:41 AM
> UTC Time: June 2, 2017 3:41 PM
> From: leo@...ulari.name
> To: Qhdwns123 <qhdwns123@...tonmail.com>
> oss-security@...ts.openwall.com <oss-security@...ts.openwall.com>
>
> On Fri, Jun 02, 2017 at 09:09:09AM -0400, Qhdwns123 wrote:
> > Hi
> >
> > What happens in order to get CVE numbers
>
> In order to get a CVE assignment, you can fill out the CVE request form:
>
> https://cveform.mitre.org/
>
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
