[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Zr0Z0vSW19REOqVD@aeon>
Date: Wed, 14 Aug 2024 15:55:46 -0500
From: Mark Esler <mark.esler@...onical.com>
To: oss-security@...ts.openwall.com
Subject: Re: Tracking down a lost CVE request (MITRE)
MITRE is not required to assign CVEs.
It is always best to work with upstream (if possible). MITRE is more
likely to respond if upstream replies to your email ticket ACKing the
CVE request. Otherwise, you may want to ask Red Hat's CNA to assign a
CVE [0].
Upstream has already agreed that this is a vulnerability in their fix
commit message [1], so assignment should be easy to justify to either
group if you provide the commit link as a reference.
Note that upstream's publication of a fix is now considered Public
Disclosure according to the CVE Program [2].
[0] https://access.redhat.com/articles/red_hat_cve_program
[1] https://github.com/NagiosEnterprises/ndoutils/commit/18ef12037f4a68772d6840cbaa08aa2da07d2891
[2] https://www.cve.org/ResourcesSupport/Glossary#glossaryPubliclyDisclosed
p.s., This does not apply here, but if MITRE *had* assigned a CVE and
ignores a request, a dispute could be brought to the CVE Program's
Secretariat (who works for MITRE).
On Tue, Aug 06, 2024 at 11:10:06AM -0400, Michael Orlitzky wrote:
> Couldn't think of a better place to ask this. I requested a CVE back in
> March for an issue with the installed permissions in Nagios's NDOUtils.
> I think the request ID was #1620090.
>
> I received a confirmation, but never got a follow-up response. I've
> since replied to the CVE-Request@ address, and have filled out the form
> with an "other" request asking for an update, but haven't heard back.
> New requests are obviously still being issued -- is there some way to
> find out what happened to this one?
>
> FWIW:
>
> Before NDOUtils-2.1.4 (released five days ago), the upstream Makefile
> would install the "ndo2db" daemon executable with the same owner/group
> that it is intended eventually to run as (namely: "nagios"). But the
> daemon is designed to be started as root and drop privileges to that
> user. If the "nagios" user can edit a binary that root will run, he can
> gain root privileges.
>
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
