[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <YfWgu/Uv+2r3TpdL@jasmine.lan>
Date: Sat, 29 Jan 2022 15:16:59 -0500
From: Leo Famulari <leo@...ulari.name>
To: John Helmert III <ajak@...too.org>
Cc: oss-security@...ts.openwall.com
Subject: Re: WebKitGTK and WPE WebKit Security Advisory
WSA-2022-0001
On Mon, Jan 24, 2022 at 08:13:15AM -0600, John Helmert III wrote:
> I don't think it makes much sense for every downstream to make these
> kinds of assumptions.
Why not? History shows that this assumption will almost always be
correct for WebKit.
> Besides, this doesn't seem to be what's
> happening in practice. For example, WSA-2021-0006 was released on
> October 26, 2021 with vulnerabilities addressed in 2.34.0, released on
> September 22, but RedHat's bugs for it were only opened in the days
> after the *security advisory's* release, not the software release. It
> doesn't help that most most distribution security tooling seems to be
> oriented around CVEs, which aren't released for WebKit until after the
> associated advisory.
I'm sure that Red Hat's package maintainers know what a WebKit update
means. Presumably they are busy and their KPIs prioritize fixing CVEs,
so they don't act as proactively as one might prefer.
In general, it seems that WebKit is handling these issues like Linux.
Observers know that important bugs are fixed constantly in software of
this size and complexity. Relying only on CVEs is too reactive and
limited in scope to provide a meaningful security stance, increasingly
so since the CVE assignment system stopped working in the last few
years.
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
