[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ah8__bTk_qGYMjrQ@symphytum.spacehopper.org>
Date: Tue, 2 Jun 2026 21:41:33 +0100
From: Stuart Henderson <stu@...cehopper.org>
To: oss-security@...ts.openwall.com
Subject: Re: BIRD/BIRD2: stack buffer overflow in BGP AS_PATH
mask matching, CVE pending
On 2026/06/02 21:14, Dan Yefihmov wrote:
> On June 2, 2026 8:27:14 PM GMT+03:00, Stuart Henderson <stu@...cehopper.org> wrote:
> >Yes, I did. That doesn't rule out things like "don't plan to fix because
> >it's no longer an issue".
> >
> Didn't you think that in that case it's considerably more reasonable to explicitly write: "It's already fixed, and the fix will be in the next release scheduled at ..." instead of "We don't CURRENTLY plan to fix it"?
I'm not sure if you're aware of the sheer number of reports that
widely-used projects are receiving recently.
>From the talk I linked to, for BIRD from the start of 2026 up to 19 May,
that was *70*. The ones I've seen (not for BIRD) they're often extremely
verbose, and they're often plain wrong (the talk suggests ~ 9% of the
reports for BIRD were valid).
At this point I think it is fairly reasonable for small development
teams to not spend all that much time researching a lower-effort
report. If it's valid there will likely be a handful of duplicate
reports coming along soon afterwards anyway, and hopefully one of
those may have done more triage before sending out.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
