[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20201117102424.GE28237@suse.de>
Date: Tue, 17 Nov 2020 11:24:24 +0100
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Cc: "David A. Wheeler" <dwheeler@...eeler.com>
Subject: Re: Buffer Overflow in raptor widely unfixed in Linux
distros
On Mon, Nov 16, 2020 at 08:06:15PM +0100, Marius Bakke wrote:
> "David A. Wheeler" <dwheeler@...eeler.com> writes:
>
> > If you think that CVE assignment is still of “fluctuating reliability” I’d like to hear that argument
> > and get it fixed. It’s normally better to fix the standard process for doing something than
> > to create yet another process that runs in parallel. I’ve seen no recent evidence of this reliability issue.
>
> Speaking as a co-maintainer of an understaffed GNU/Linux distribution
> who fixed this back in 2017[0], I preferred the "old days" when free
> software security problems were almost always discussed on this list.
>
> While there's no questioning the utility of CVEs in general (Guix can
> check the CVE list for any given package with 'guix lint -c cve PKG'),
> there are still unresolved CPE mappings, and I don't know how to get
> informed of new problems without checking specific (or all) packages.
>
> I tried following the CVE assignment RSS feed initially, but it was not
> suitable for human consumption.
>
> How do other distros keep up with new CVE assignments?
SUSE has an internal ticket system like tool that fetches from various
sources:
- NVD
- SUSE Bugzilla
- Oracle CPU CVRF feeds
- Redhat, Canonical trackers
And presents this as ticketstyle input.
We have assigned engineers going through all incoming ones, reviewing,
associating packages, codestreams and products, and CVSS v3.1 ratings in this
tool and opening Bugreports in our Bugzilla for our packagers.
Without some ticketing system like tooling you will not be able to keep up
these days.
Ciao, Marcus
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
