Home page logo

oss-sec logo oss-sec mailing list archives

Re: Fwd: Apache HTTP Server 2.2.22 Released
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 31 Jan 2012 19:49:05 -0700

On 01/31/2012 05:42 PM, Solar Designer wrote:
I think that only posting to oss-security when there's not yet a CVE ID
assigned (to request one) is weird.  I think it may be more beneficial
to post in here about all security issues in Open Source software -
well, or at least in widely used pieces of software.  As a special case,
when an issue that was first discussed on the private linux-distros or
distros lists is made public, I think this should include a posting to
oss-security (and not only vendor advisories sent via their usual
channels, which vary by vendor).  (No, the Apache issues below were not
on the distros lists.)

Agreed, one thing that would be helpful is to start all CVE requests
with "CVE Request" in the subject line which will make it easy for me to
spot them. Anything informational can be whatever title (like what Solar
Designer sent).

On the other hand how much overlap do we want with full-disclosure/bugzilla?

Kurt Seifried Red Hat Security Response Team (SRT)

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]