oss-security - ATutor CVE-2017-1000002, CVE-2017-1000003, CVE-2017-1000004

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170716120139.ivmlgyaqwxrp2mhl@tunkki>
Date: Sun, 16 Jul 2017 15:01:39 +0300
From: Henri Salo <henri@...v.fi>
To: kurt@...fried.org
Cc: oss-security@...ts.openwall.com, mattd@...fuzz.com
Subject: ATutor CVE-2017-1000002, CVE-2017-1000003, CVE-2017-1000004

Hello Kurt,

You have assigned CVE-2017-1000002, CVE-2017-1000003 and CVE-2017-1000004 (URLs
below) for ATutor vulnerabilities. Why doesn't the CVE data have information of
the fixed in version even it's clearly available in the reference data, which
refers to URL showing that the vulnerabilities are fixed in 2.2.2 version? Isn't
it supposed to be available in CVE database? I'm just trying to understand how
DWF works, because it's not very clear to me.

How long it usually takes that DWF assigned CVEs end up being added to MITRE
and NVD databases?

I can't actually see contents of upstream bug report even I registered
user-account: http://www.atutor.ca/atutor/mantis/view.php?id=5681

Is this assigment somehow related to this oss-security post?
http://www.openwall.com/lists/oss-security/2016/07/01/3

This has also been pending for over a year. Is this related to these new
assigments or does this still need new CVE?
https://www.htbridge.com/advisory/HTB23297

Also I noticed following text in the DWF-CVE-Database README.md: "Please note
that some of the data from 2015 and 2016 needs to be brought up to date to the
current JSON v.4 format, if you'd like to do this please do so and submit a pull
request." isn't this something that should be done by DWF maintainers and maybe
the CVE mentors and not wait pull requests?

https://raw.githubusercontent.com/distributedweaknessfiling/DWF-CVE-Database/master/2017/1000xxx/CVE-2017-1000002.json
https://raw.githubusercontent.com/distributedweaknessfiling/DWF-CVE-Database/master/2017/1000xxx/CVE-2017-1000003.json
https://raw.githubusercontent.com/distributedweaknessfiling/DWF-CVE-Database/master/2017/1000xxx/CVE-2017-1000004.json

-- 
Henri Salo

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.