Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: Re: Xen Security Advisory 82 (CVE-2013-6885) - Guest triggerable AMD CPU erratum may cause host hang
From: Kurt Seifried <kseifried () redhat com>
Date: Mon, 02 Dec 2013 18:18:53 -0700

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 12/02/2013 04:35 PM, cve-assign () mitre org wrote:
This was sent by MITRE as part of the CVE assignment. It seems
likely to us (the Xen Project security team) that the CVE
assignment was a consequence of our embargoed predisclosure to
xen-security-issues.

MITRE typically does not know about multi-party embargo
arrangements affecting Linux vendors and various other vendors, and
did not know about any multi-party embargo arrangement in this
case. If anyone who is regularly involved in vulnerability
remediation affecting the open-source community asks MITRE to send
an announcement of a CVE assignment to oss-security, we send that
announcement without any investigation of disclosure restrictions.
Although it is unfortunate if such an announcement had an adverse
effect on a planned disclosure timeline, we feel that this is an
isolated case and does not mean that we need to reevaluate our
approach. Also, once an issue is mentioned on oss-security by
anyone, we consider the issue fully public and we sometimes proceed
to publish a CVE immediately.

To be clear I asked Mitre for the CVE for AMD (since it's not open
source software). I didn't think to tell them it was embargoed since
the AMD release notes and so on were public. However in future with
hardware related CVE's I'll make sure to ask Mitre to keep them
private if the software side is still embargoed as appropriate.


- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.15 (GNU/Linux)

iQIcBAEBAgAGBQJSnTF9AAoJEBYNRVNeJnmTQc0P/1KnCOkN+zJrrw8XuX+IaFnG
PU8k+7H7L4gNv0Cuy2aaFZiWOaOu2BHuQ8kPNdQlcRjKxfAo6TIzxKjRHAfdjAwh
RTExqkGGp1twzWeYa//509fb3qXIjZ0g0FAqkLHg/8aBds7Dpu4dpk1169LM4/jo
nFIB32Izrzl+P4SO99FhiW/k3HmE7YHlqliGNNpiOGAZkCB/xouGns9z4iL90vcY
BQsaqRdSTFtxc84Y8ws1lk5lxDdgAKV10/cpZZyPpJm2dk9bG+slFrJ2hL8Y+b93
2Q30LIQrx4cfF9D+djXXckuxQzP+dCfikcIKER/tWX11ZoRoDB35pT7pMPy/X6W0
jJ3ijcZqgsfH4GZnTUIjccLC2RMXEEsb2ZueTgaSJ315giLxaZFanfekA/44fds4
Wg/tlchEKiBrlKBNRTqsqrud0DAL2fQny/J8Dg2VIAqC3FQOdipaTthYkjrcofOP
WWf78D95+PC4txB2kpbY05AA1eDvdtmvIeBbtDnzkG8UU+KxuYmfd3Al7J2I+AqV
avavh/akdyWkCC59LiVB2aRA3J7Ovr3V2dsQkO60i52ClYR1E6d9xiKLmU6Y8kFL
hpHcRqIROJvwOOUOrZGQRzFAZXmN/WKJNaN2p6vo+L19u/Rsf838pSsa6NDUblq/
Ca30JT72lmgzyuq/qgKF
=ncvQ
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault