oss-security - Re: using oss-security references in CVE

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080327235843.GA26542@openwall.com>
Date: Fri, 28 Mar 2008 02:58:43 +0300
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: using oss-security references in CVE

Steve,

On Thu, Mar 27, 2008 at 06:59:27PM -0400, Steven M. Christey wrote:
> In CVE, we try to provide "provenance" for every detail that makes its way
> into the description.  Issues like rxvt and CenterIM have some details
> that are only publicly documented in oss-security, and I would like to add
> these as references.

That would be great.

> However, I haven't done so yet.  If I start to add oss-security references
> to CVEs when needed, this will be noticed by the other vuln DBs and added
> to their watch lists.  As their response is sometimes faster than CVE's,
> this means that new vuln reports will start showing up publicly much more
> quickly.

Isn't that actually desirable?  I mean, stuff being posted to
oss-security is supposed to be either already public or intended to be
made public right away.

> Are people OK with that?

Please go for it!

If you can, please use the official archive URLs, currently at:

	http://www.openwall.com/lists/oss-security/

In case this is moved - e.g., to the oss-security website - we'll make
sure to put proper redirects in place, such that every message's URL
remains valid.  While the software powering this archive is currently
quite spartan, I think it suffices this purpose (CVE refs) well - and
its further development was just revitalized.

By the way, maybe we should also add a link to the oss-security wiki to
page footers on that archive?  Or even to message trailers (such that
the wiki link will be seen on third-party archives as well)?

Oh, and someone should write a wiki page about getting CVE IDs.  This is
currently mentioned as a FIXME here:

	http://oss-security.openwall.org/wiki/disclosure/researcher

Thanks,

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.