[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1008241257000.25810@faron.mitre.org>
Date: Tue, 24 Aug 2010 13:00:27 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Tomas Hoger <thoger@...hat.com>
cc: oss-security@...ts.openwall.com, pierre.php@...il.com,
Thomas Biege <thomas@...e.de>, Moritz Muehlenhoff <jmm@...ian.org>,
"Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: PHP MOPS-2010-56..60
On Tue, 24 Aug 2010, Tomas Hoger wrote:
> Standard practice is to use new CVE. As all 5 phar MOPS were covered
> under single CVE, and not all of them were fixed in 5.3.3, I'd expect a
> new "incomplete fix" CVE.
That's appropriate in this case. I'll let Josh assign a CVE to avoid the
possibility of dupes.
General practice (subject to modification on a case-by-case basis) is:
- issue was never fixed and never claimed to be fixed: use original CVE
(probably triggers an update to description for affected versions)
- issue was claimed fixed but the fix was incomplete: use new CVE
- issue was never fixed but claimed to be fixed: ??? (it's happened a few
times)
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
