[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20201116231142.GA2956665@millbarge>
Date: Mon, 16 Nov 2020 23:11:42 +0000
From: Seth Arnold <seth.arnold@...onical.com>
To: oss-security@...ts.openwall.com
Subject: Re: Buffer Overflow in raptor widely unfixed in Linux
distros
On Mon, Nov 16, 2020 at 08:06:15PM +0100, Marius Bakke wrote:
> I tried following the CVE assignment RSS feed initially, but it was not
> suitable for human consumption.
>
> How do other distros keep up with new CVE assignments?
We (Ubuntu security team) have weekly role rotations among the team. The
person on CVE triage duty will use our tooling to download
https://cve.mitre.org/data/downloads/allitems.xml.gz
https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-recent.json.gz
https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2020.json.gz
https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2019.json.gz
etc
We also pull from Debian's security team:
https://salsa.debian.org/security-tracker-team/security-tracker.git
We collect CVEs from this list using local mboxes.
We collect CVEs from Red Hat's security announce list:
https://www.redhat.com/archives/rhsa-announce/
and oval feeds:
https://www.redhat.com/security/data/oval/v2/RHEL8/
Having a variety of inputs gives us some resiliency when one or another
service is offline for whatever reason,
I hope this helps.
Thanks
Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
