[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130227150858.GA23550@openwall.com>
Date: Wed, 27 Feb 2013 19:08:58 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request - Linux kernel: VFAT slab-based buffer overflow
On Wed, Feb 27, 2013 at 06:48:34AM -0800, Greg KH wrote:
> On Wed, Feb 27, 2013 at 07:31:30AM +0100, Petr Matousek wrote:
> > For starters, security@...nel.org submissions should be posted to
> > oss-security or any other security related public mailing list when the
> > patch is being committed.
>
> That's not going to happen, and you know that, to do so would be totally
> irresponsible of us and directly harm your users.
Huh?! Maybe you misread what Petr wrote? Note: "when the patch is
being committed". At this point, the security issue is public, and it
just needs to be properly communicated to all those interested
(including distros, sysadmins, etc.), such as via oss-security. Not
doing this favors those few who spend time to review commits on their
own; some of them do it for purposes other than informing the public.
We have a similar policy for the distros and linux-distros private
lists. When an issue initially brought up there is finally made public,
it must be brought up on oss-security. I must admit there were a few
cases where we failed to do that, but they were just that - failures.
I'd appreciate help of other distros/linux-distros list members to
ensure that each and every issue is brought to oss-security when it is
being made public (even if only via commits of the fixes). Formally,
this is responsibility of the original reporter:
http://oss-security.openwall.org/wiki/mailing-lists/distros
"When the security issue is finally to be made public, it is your (the
original reporter's) responsibility to post about it to oss-security
(indeed, you and others may also post to any other mailing lists, etc.)"
but in practice the original reporter sometimes fails to do that, in
which case the list members should remind the reporter and/or take care
of bringing the issue to oss-security themselves.
I think security@...nel.org should adopt a similar policy, and someone
on that list should be enforcing it.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
