[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <86CF08FC-173D-42AE-B0FD-451FBCA0A724@edvina.net>
Date: Tue, 4 Nov 2025 12:03:55 +0100
From: "Olle E. Johansson" <oej@...ina.net>
To: oss-security@...ts.openwall.com
Subject: Re: Questionable CVE's reported against dnsmasq
> On 3 Nov 2025, at 19:07, Art Manion <zmanion@...tonmail.com> wrote:
>
> On 2025-11-02 03:30, Olle E. Johansson wrote:
>>
>>
>>> On 1 Nov 2025, at 04:00, Solar Designer <solar@...nwall.com> wrote:
>>>
>>> CVEs against dnsmasq (CVE-2025-12198, CVE-2025-12199, CVE-2025-12200)
>>> and Kamailio (CVE-2025-12204, CVE-2025-12205, CVE-2025-12206, and
>>> CVE-2025-12207) mentioned in this thread are not yet disputed and have
>>> no comments of this sort in their descriptions.
>
> I asked VulDB to mark the dnsmasq CVE IDs as disputed.
Ok
>
>> As part of the Kamailio project I can say that we did just become aware
>> of these CVEs in your email. They do not make sense. Trying to get to
>> the report, the config files used to provoke the issue can’t be downloaded.
>>
>> If you have access to edit the config files, there are much more simple
>> ways to cause damage than to provoke a problem in the config file parser.
>>
>> We will have an internal discussion but that will likely lead to the
>> project disputing these CVEs.
>
> Hello Olle! I was going to do o the same for the Kamailio CVE IDs but
> defer to the project's decision. If you do decide to dispute, the first
> request should go to VulDB:
>
> https://www.cve.org/PartnerInformation/ListofPartners/partner/VulDB
Ok.
We’ve gone back and this was our core developer’s reaction to the mail we got earlier to our security address:
"This is clearly spam, imo: vague/generic reporting, no explicit naming
of Kamailio ... the email was not sent from the vuldb.com server
but from mc20a2201.dnh.net ([185.46.57.114]) -- I would suggest to not
clink on the links, they might lead to malware, etc...
Remember that this mailing list is open for anyone to send to it, in
order to allow anyone to report security issues, but that means spammers
can send messages to it are well. There is a spammassassin instance on
kamailio.org, but some messages can go though, therefore always be
careful with the messages on this list, especially if the author is not
known.
“
So we ignored it. We may want to look into how someone like vulndb reaches
out to projects. And vulndb should propably raise the bar a bit for what they accept
as CVEs.
/O
>
> (I accidentally asked the MITRE CNA-LR first.)
>
> Regards,
>
> - Art
>
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
