Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE Requests
From: Mark Stanislav <mark.stanislav () gmail com>
Date: Fri, 16 Mar 2012 12:11:04 -0400

All points being made are very much valid and I certainly understand how
contextually oss-sec may be used to allocation requests under different

So here's my situation, I'm up for suggestions (of which, "wait longer", is
perfectly viable!)...

1) March 1st, I sent 2 of these CVEs over to Steve Christy at MITRE who had
previously allocated 9 prior CVEs in a day or two generally
2) March 8th, after not hearing back from Steve, I contacted
cve () mitredirectly with all 5
3) March 15th, after not hearing back from MITRE, I contacted Kurt off list
as I've noted his helpfulness doing allocations
3a) Kurt pointed me to email the list, rather than him directly (which is
perfectly fine, but perhaps not the context I was aiming for initially)

So we're moving past two weeks, I have 5 CVEs I am trying to allocate and
talk with all of these developers to get on the same page which. None of
these vulnerabilities are exactly going to rock the security world (see:
CVE-2012-0002) but I'd love to be able to handle the process as MITRE
intends (Introduction to CVE Identifier Reservation -
http://cve.mitre.org/cve/cna.html) as I have previously 9 times with a lot
of success.

I apologize if these requests fell outside of the regular scope of the
list, but at this point I am just trying to get this process done with :)


On Fri, Mar 16, 2012 at 11:54 AM, Adam D. Barratt
<adam () adam-barratt org uk>wrote:

On 16.03.2012 10:26, Andreas Ericsson wrote:

Those mails are all exemplary requests for CVE id's, ofcourse, but the
fact that they are all already fixed and released means that 100% of
the work is already done. At that point, assigning a CVE id is mostly
useless and is done as a "just for the record" thing.

Whether you consider it useless or not, those are the CVE assignments that
will happen on the list, aiui.

 says: "Public security issues only please. What you say here
is public for the world to see - keep that in mind. Embargoed information
is best disclosed to vendor-sec" (which should be updated to point at
somewhere that actually exists).



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]