Re: Buffer Overflow in raptor widely unfixed in Linux distros

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Re: Buffer Overflow in raptor widely unfixed in Linux distros

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: "David A. Wheeler" &lt;dwheeler () dwheeler com&gt;

Date: Mon, 16 Nov 2020 12:43:10 -0500

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->

On Fri, Nov 13, 2020 at 01:33:31PM +0100, Hanno Böck wrote:
3 years ago I reported a heap overflow vulnerability in raptor, an RDF
parsing library:
https://www.openwall.com/lists/oss-security/2017/06/07/1 &lt;https://www.openwall.com/lists/oss-security/2017/06/07/1&gt; 
,,,
Maybe noteworthy is that this didn't get a CVE in 2017. It seems many
distros rely on CVEs to get a process of backporting fixes rolling.
Given the fluctuating reliability of CVE assignments not sure this is
wise. I have now requested a CVE (CVE-2017-18926).
...

On Nov 14, 2020, at 6:58 AM, Marcus Meissner &lt;meissner () suse de&gt; wrote:
I think the only thing you can do additional is to request a CVE.

All tracking by everyone is using CVEs, this is the core identifier
of the software security world.

I think this is key. If you find a vulnerability, you typically need to ensure that it gets
a CVE assigned if you want coordination &amp; resolution to happen. It's how coordination happens.
There are issues with CVEs, but I’ve never seen a CVE assignment
get dropped in recent years once it was requested properly.
Delayed, yes, but I know CVE assignments don’t take 3 years :-).
And yes, there are special issues with the Linux kernel, but this package isn’t the Linux kernel.

If you think that CVE assignment is still of “fluctuating reliability” I’d like to hear that argument
and get it fixed. It’s normally better to fix the standard process for doing something than
to create yet another process that runs in parallel. I’ve seen no recent evidence of this reliability issue.

Sing this (to “Single Ladies”):
"If you like it, then you shoulda put a CVE on it...:"

--- David A. Wheeler

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

Buffer Overflow in raptor widely unfixed in Linux distros Hanno Böck (Nov 13)

Re: Buffer Overflow in raptor widely unfixed in Linux distros David A. Wheeler (Nov 13)

Re: Buffer Overflow in raptor widely unfixed in Linux distros Dave Horsfall (Nov 14)

Re: Buffer Overflow in raptor widely unfixed in Linux distros Dave Horsfall (Nov 14)

Re: Buffer Overflow in raptor widely unfixed in Linux distros Ian Zimmerman (Nov 18)

Re: Buffer Overflow in raptor widely unfixed in Linux distros Marcus Meissner (Nov 14)

Re: Buffer Overflow in raptor widely unfixed in Linux distros David A. Wheeler (Nov 16)

Re: Buffer Overflow in raptor widely unfixed in Linux distros Stephen John Smoogen (Nov 16)
Re: Buffer Overflow in raptor widely unfixed in Linux distros Sam James (Nov 16)

Re: Buffer Overflow in raptor widely unfixed in Linux distros Marius Bakke (Nov 16)
Re: Buffer Overflow in raptor widely unfixed in Linux distros Jeremy Stanley (Nov 16)

Re: Buffer Overflow in raptor widely unfixed in Linux distros Sam James (Nov 16)

Re: Buffer Overflow in raptor widely unfixed in Linux distros Seth Arnold (Nov 16)

Re: Buffer Overflow in raptor widely unfixed in Linux distros Marcus Meissner (Nov 17)

Re: Buffer Overflow in raptor widely unfixed in Linux distros Morten Linderud (Nov 17)

Re: Buffer Overflow in raptor widely unfixed in Linux distros Salvatore Bonaccorso (Nov 16)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->