[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <alpine.GSO.2.20.1708291116010.12310@scrappy.simplesystems.org>
Date: Tue, 29 Aug 2017 11:44:53 -0500 (CDT)
From: Bob Friesenhahn <bfriesen@...ple.dallas.tx.us>
To: oss-security <oss-security@...ts.openwall.com>
Subject: Re: A bunch of duplicate CVEs requested for?? bho..
On Tue, 29 Aug 2017, Agostino Sarubbo wrote:
> Hi all.
>
> In the last time there are some people that run afl for fuzzing...that's just
> fine and great. Some people miss to communicate their findings to upstream and
> request a CVE from mitre.
> However I'm noticing that every day there are new duplicates, let me post some
> examples:
It is important to keep in mind that CVEs are issued against
"products". There might be a CVE issued against a software version
distributed by Red Hat or Debian which is not applicable to the
upstream version. Since each distribution patches their version it is
difficult to know the "product" that a particular CVE is applicable
to.
I agree that in my personal experience upstream maintainers are rarely
involved in the CVE process.
Bob
--
Bob Friesenhahn
bfriesen@...ple.dallas.tx.us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer, http://www.GraphicsMagick.org/
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
