Re: Contributing Back

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Re: Contributing Back

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Zhang Xiao &lt;xiao.zhang () windriver com&gt;

Date: Thu, 23 Jul 2020 17:42:33 +0800

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->

在 2020/7/23 下午4:21, Mohammad Tausif Siddiqui 写道:

On Tue, Jul 21, 2020 at 12:12 AM Solar Designer &lt;solar () openwall com
&lt;mailto:solar () openwall com&gt;&gt; wrote:

    On Mon, Jul 13, 2020 at 03:37:03PM +0800, Zhang Xiao wrote:
    &gt; ??? 2020/7/12 ??????1:58, Solar Designer ??????:
    &gt; &gt; On Thu, Jul 02, 2020 at 05:33:20PM +0800, Zhang Xiao wrote:
    &gt; &gt;&gt; And, I have another point want to discuss. As we know,
    sometimes, the CVE and NVD website don't upgrade their web page
    timely. For example:
    &gt; &gt;&gt;
    &gt; &gt;&gt; the security maillist had an encrypted mail called "curl:
    overwrite local file with -J" in 20200617. It was a
    "pre-notification about a security advisory about to ship next
    week in sync with our next curl release", for CVE-2020-8177. On
    curl's git tree, that very bug did been fixed and released in
    20200621:
    &gt; &gt;&gt; https://github.com/curl/curl/commit/8236aba5854
    &gt; &gt;&gt;
    &gt; &gt;&gt; But, till now, both cve.mitre.org &lt;http://cve.mitre.org&gt; and
    nvd.nist.gov &lt;http://nvd.nist.gov&gt; still mark this CVE as "RESERVED":
    &gt; &gt;&gt; https://nvd.nist.gov/vuln/detail/CVE-2020-8177
    &gt; &gt;&gt; https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8177
    &lt;https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8177&gt;
    &gt; &gt;&gt;
    &gt; &gt;&gt; So I wonder if that is also an contribution to remind them,
    if so, any advises to make it? And If it ca be defined as an
    contribution, we can take it. :-)
    &gt; &gt; We've received some responses in this thread regarding the
    specific
    &gt; &gt; example above, but I'd like more general responses please.&nbsp; Is
    there a
    &gt; &gt; general task Wind River can reasonably help with for getting
    CVE details
    &gt; &gt; published for issues that pass the distros and/or oss-security
    lists,
    &gt; &gt; and how exactly could they help with that?
    &gt;
    &gt; Actually, we are glad to make it for some customers are also pay
    &gt; attention on these official web pages. We suppose it will be easy to
    &gt; make it through the "notify a vulnerability publication
    &gt; &lt;https://cveform.mitre.org/&gt;". But after I submitted the request
    I just
    &gt; get a reply as "This CVE ID has been reserved by the CNA
    Hackerone and
    &gt; we are currently waiting on them to submit the details." Seems
    only "the
    &gt; CNA Hackerone" can make it. I have no idea on how to notify the
    "the CNA
    &gt; Hackerone " to push it. :-(п╠Б∙░ Anyway, if possible we are glad
    to make it.

    Once again, I think CVE-2020-8177 is more of an exception than the
    rule.
    I would be more interested in comments by "CVE experts" on whether the
    task Xiao proposes and volunteers for is in general worthwhile or not,
    and why.&nbsp; Would similar "notify a vulnerability publication" reminders
    be desirable for issues that got the CVE IDs from one of the CNAs
    on the
    distros list?

Xiao, Alexander,

I think the ball is on the CNA: Hackerone side to get it published to
MITRE, so
that they can show it up on their page.

CNAs are provided with weekly reports by the root CNA: MITRE, which lists
Reserved But Public "RBP" CVEs owned by that CNA, irrespective of
whether the
CVE was assigned on distros list or elsewhere. That closes the
reminder loop.

There's no pull request for CVE-2020-8177 at
https://github.com/CVEProject/cvelist/pulls
We cannot determine if they used the alternative, web
form:https://cveform.mitre.org/ &lt;https://cveform.mitre.org/&gt;

You may want to reach Hackerone from the CNA contacts
&lt;https://cve.mitre.org/cve/request_id.html#cna_participants&gt;, for this
exception of delay.

For these two CVEs, I mailed to support () hackerone com&nbsp; ten days ago but
haven't get any reply yet. :-(

Thanks

Xiao

Kind regards&nbsp;
-- 

Tausif&nbsp;Siddiqui, PRODUCT SECURITY

0EE1 F6BF 8991 9A65 0A79 A0A7 5849 60EC 88B8 2C71

secalert () redhat com
&lt;https://access.redhat.com/security/team/contact&gt;&nbsp;for urgent response.

Attachment:
pEpkey.asc
Description: 

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

Contributing Back Zhang Xiao (Jul 02)

Re: Contributing Back Francis Perron (Jul 02)

Re: Contributing Back Daniel Stenberg (Jul 02)

Re: Contributing Back Zhang Xiao (Jul 02)

Re: Contributing Back Solar Designer (Jul 11)

Re: Contributing Back Zhang Xiao (Jul 13)

Re: Contributing Back Solar Designer (Jul 20)
Re: Contributing Back Mohammad Tausif Siddiqui (Jul 23)
Re: Contributing Back Zhang Xiao (Jul 23)

Re: Contributing Back Solar Designer (Jul 23)
Re: Contributing Back Zhang Xiao (Jul 28)

&lt;Possible follow-ups&gt;
Re: Contributing Back Solar Designer (Sep 03)

Re: Contributing Back Seth Arnold (Sep 03)

Re: Contributing Back Vincent Batts (Sep 09)

 

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->