Re: Contributing Back

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Re: Contributing Back

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Solar Designer &lt;solar () openwall com&gt;

Date: Mon, 20 Jul 2020 20:40:54 +0200

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
On Mon, Jul 13, 2020 at 03:37:03PM +0800, Zhang Xiao wrote:
??? 2020/7/12 ??????1:58, Solar Designer ??????:
On Thu, Jul 02, 2020 at 05:33:20PM +0800, Zhang Xiao wrote:
And, I have another point want to discuss. As we know, sometimes, the CVE and NVD website don't upgrade their web 
page timely. For example:

the security maillist had an encrypted mail called "curl: overwrite local file with -J" in 20200617. It was a 
"pre-notification about a security advisory about to ship next week in sync with our next curl release", for 
CVE-2020-8177. On curl's git tree, that very bug did been fixed and released in 20200621:
https://github.com/curl/curl/commit/8236aba5854

But, till now, both cve.mitre.org and nvd.nist.gov still mark this CVE as "RESERVED":
https://nvd.nist.gov/vuln/detail/CVE-2020-8177
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8177

So I wonder if that is also an contribution to remind them, if so, any advises to make it? And If it ca be defined 
as an contribution, we can take it. :-)
We've received some responses in this thread regarding the specific
example above, but I'd like more general responses please.  Is there a
general task Wind River can reasonably help with for getting CVE details
published for issues that pass the distros and/or oss-security lists,
and how exactly could they help with that?

Actually, we are glad to make it for some customers are also pay
attention on these official web pages. We suppose it will be easy to
make it through the "notify a vulnerability publication
&lt;https://cveform.mitre.org/&gt;". But after I submitted the request I just
get a reply as "This CVE ID has been reserved by the CNA Hackerone and
we are currently waiting on them to submit the details." Seems only "the
CNA Hackerone" can make it. I have no idea on how to notify the "the CNA
Hackerone " to push it. :-(&nbsp; Anyway, if possible we are glad to make it.

Once again, I think CVE-2020-8177 is more of an exception than the rule.
I would be more interested in comments by "CVE experts" on whether the
task Xiao proposes and volunteers for is in general worthwhile or not,
and why.  Would similar "notify a vulnerability publication" reminders
be desirable for issues that got the CVE IDs from one of the CNAs on the
distros list?

Thanks,

Alexander

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

Contributing Back Zhang Xiao (Jul 02)

Re: Contributing Back Francis Perron (Jul 02)

Re: Contributing Back Daniel Stenberg (Jul 02)

Re: Contributing Back Zhang Xiao (Jul 02)

Re: Contributing Back Solar Designer (Jul 11)

Re: Contributing Back Zhang Xiao (Jul 13)

Re: Contributing Back Solar Designer (Jul 20)
Re: Contributing Back Mohammad Tausif Siddiqui (Jul 23)
Re: Contributing Back Zhang Xiao (Jul 23)

Re: Contributing Back Solar Designer (Jul 23)
Re: Contributing Back Zhang Xiao (Jul 28)

&lt;Possible follow-ups&gt;
Re: Contributing Back Solar Designer (Sep 03)

Re: Contributing Back Seth Arnold (Sep 03)

Re: Contributing Back Vincent Batts (Sep 09)

 

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->