[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <FC72FC641B949240B947AC6F1F83FBAF0904EC2B@IMCMBX01.MITRE.ORG>
Date: Thu, 21 Mar 2013 14:05:13 +0000
From: "Christey, Steven M." <coley@...re.org>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
"larry Cashdollar" <larry0@...com>
CC: "kseifried@...hat.com" <kseifried@...hat.com>
Subject: RE: Ruby CVEs
I agree with Alexander. The CVE assignment process is never intended to introduce unnecessary delays to the publication of vulnerability information. Merely noting whether CVEs have already been requested should reduce most of the risk of duplicates without forcing people to delay publication.
- Steve
>-----Original Message-----
>From: Solar Designer [mailto:solar@...nwall.com]
>Sent: Wednesday, March 20, 2013 10:58 PM
>To: larry Cashdollar
>Cc: oss-security@...ts.openwall.com; kseifried@...hat.com
>Subject: Re: [oss-security] Ruby CVEs
>
>[snip]
>Overall, I think all of you have tried to do the right thing, and I
>would not want to have information withheld from this list merely to
>avoid duplicate CVE IDs in the future. CVEs are handy, but the CVE
>assignment process should not affect what is posted publicly and when.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
