Home page logo

oss-sec logo oss-sec mailing list archives

RE: Ruby CVEs
From: "Christey, Steven M." <coley () mitre org>
Date: Thu, 21 Mar 2013 14:05:13 +0000

I agree with Alexander.  The CVE assignment process is never intended to introduce unnecessary delays to the 
publication of vulnerability information.  Merely noting whether CVEs have already been requested should reduce most of 
the risk of duplicates without forcing people to delay publication.

- Steve

-----Original Message-----
From: Solar Designer [mailto:solar () openwall com]
Sent: Wednesday, March 20, 2013 10:58 PM
To: larry Cashdollar
Cc: oss-security () lists openwall com; kseifried () redhat com
Subject: Re: [oss-security] Ruby CVEs

Overall, I think all of you have tried to do the right thing, and I
would not want to have information withheld from this list merely to
avoid duplicate CVE IDs in the future.  CVEs are handy, but the CVE
assignment process should not affect what is posted publicly and when.

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]