[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4F28A821.7010507@redhat.com>
Date: Tue, 31 Jan 2012 19:49:05 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Solar Designer <solar@...nwall.com>
Subject: Re: Fwd: Apache HTTP Server 2.2.22 Released
On 01/31/2012 05:42 PM, Solar Designer wrote:
> I think that only posting to oss-security when there's not yet a CVE ID
> assigned (to request one) is weird. I think it may be more beneficial
> to post in here about all security issues in Open Source software -
> well, or at least in widely used pieces of software. As a special case,
> when an issue that was first discussed on the private linux-distros or
> distros lists is made public, I think this should include a posting to
> oss-security (and not only vendor advisories sent via their usual
> channels, which vary by vendor). (No, the Apache issues below were not
> on the distros lists.)
Agreed, one thing that would be helpful is to start all CVE requests
with "CVE Request" in the subject line which will make it easy for me to
spot them. Anything informational can be whatever title (like what Solar
Designer sent).
On the other hand how much overlap do we want with full-disclosure/bugzilla?
--
Kurt Seifried Red Hat Security Response Team (SRT)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
