mailing list archives
RE: Ruby CVEs
From: "Christey, Steven M." <coley () mitre org>
Date: Thu, 21 Mar 2013 14:05:13 +0000
I agree with Alexander. The CVE assignment process is never intended to introduce unnecessary delays to the
publication of vulnerability information. Merely noting whether CVEs have already been requested should reduce most of
the risk of duplicates without forcing people to delay publication.
From: Solar Designer [mailto:solar () openwall com]
Sent: Wednesday, March 20, 2013 10:58 PM
To: larry Cashdollar
Cc: oss-security () lists openwall com; kseifried () redhat com
Subject: Re: [oss-security] Ruby CVEs
Overall, I think all of you have tried to do the right thing, and I
would not want to have information withheld from this list merely to
avoid duplicate CVE IDs in the future. CVEs are handy, but the CVE
assignment process should not affect what is posted publicly and when.