[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAKgU3W9T6XHWjWHjQ4Yz6KiiVpVuxJKDF6e_n83oAPLZqn=Vnw@mail.gmail.com>
Date: Fri, 14 Feb 2020 11:15:02 +0100
From: Francis Perron <francisp@...gle.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE for program distributing vulnerable components ?
On Fri, Feb 14, 2020 at 10:55 AM Simon McVittie <smcv@...ian.org> wrote:
>
> On Fri, 14 Feb 2020 at 00:11:00 +0100, security minded wrote:
> > I've identified a program whose installer contains components with known
> > CVEs. Should one or several CVE be asked for the installer itself ?
>
> The CVE IDs for the individual vulnerable components are enough to
> describe the vulnerability. You don't need new CVE IDs to describe the
> fact that the installer installs vulnerable components.
To echo Simon's points:
Usually, if the code owner (here, the installer's) can fix it in their
own code to avoid the vulnerability, then you can reach out to ask for
a CVE. That being said, CVE issuing is a subjective science, and the
CNA you end up dealing with may decide not to issue one if it is
already dealt with in the underlying libraries.
Good luck!
--
Francis Perron
Vulnerability Coordination @ Google inc.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
