[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <0a64f380-fa28-2b60-5710-cd3d556949ca@windriver.com>
Date: Fri, 3 Jul 2020 10:06:55 +0800
From: Zhang Xiao <xiao.zhang@...driver.com>
To: oss-security@...ts.openwall.com, Daniel Stenberg <daniel@...x.se>,
Francis Perron <francisp@...gle.com>
Cc: xiao.zhang@...driver.com, Solar Designer <solar@...nwall.com>
Subject: Re: Contributing Back
I haven't remind MITRE before. While they have an interface to make it:
https://cve.mitre.org/about/contactus.html
See the forth topic called "*To notify us about a vulnerability
publication*". I just remind them about CVE-2020-8169 and CVE-2020-8177
with it. Hope it works. :-)
I will check the status of them on CVE/NVD website these days.
Thanks
Xiao
在 2020/7/2 下午7:34, Daniel Stenberg 写道:
> On Thu, 2 Jul 2020, Francis Perron wrote:
>
>> this delay may be possible due to many things, but the simplest
>> possibility that comes to mind is that Daniel (here cc'd) from H1 has
>> only gotten a reservation of CVE number, and he and MITRE have not
>> triggered the submission yet.
>
> In the curl project we (nowadays) request and get CVE IDs from
> Hackerone, and we've subsequently told them to publish these two
> recent curl related CVE IDs when we made them public to the world - I
> suspect this is just them being a little slow. We don't have any
> direct contact with MITRE.
>
> All details regarding the two recent curl flaws are here:
>
> https://curl.haxx.se/docs/CVE-2020-8169.html
> https://curl.haxx.se/docs/CVE-2020-8177.html
>
Content of type "text/html" skipped
Download attachment "pEpkey.asc" of type "application/pgp-keys" (2461 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
