Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE Requests
From: Kurt Seifried <kseifried () redhat com>
Date: Fri, 16 Mar 2012 11:46:55 -0600

On 03/16/2012 09:53 AM, Solar Designer wrote:
On Fri, Mar 16, 2012 at 12:20:37AM -0400, Mark Stanislav wrote:
None of the details of these issues have been publicly discussed or released as I am trying (without much success) 
to allocate a CVE prior to sending out a coordinated advisory including that identifier as I always have done and as 
the mitre site indicates to do.

There are no reference links to provide and I am not publicizing details on this list before the developer can be 
informed of the CVE.

I'm happy to take this off list as I am sure no one cares about any of this discussion

In which case you can ask for them on VS@ list where the issue will
remain embargoed. If the issue is so sensitive you cannot leak
details/etc then you need to contact Mitre directly (this will also
ensure no duplicates/etc.).

No, please keep this on the list.  Discussions on how to handle
vulnerability disclosure (including the CVE ID assignment step) are
definitely on topic for oss-security.

Yes and I need to finish documenting this stuff (it's become obvious we
need to educate people on how the system works and why it works that
way, we're not insane, we have good reasons for doing it the way we do,
honest =).


(a moderator for oss-security)

Kurt Seifried Red Hat Security Response Team (SRT)

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]