Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5056

Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

Show all headers | View raw

On Tue, Oct 11, 2016 at 08:04:33PM -0000, te3d4q@sigaint.org wrote:
> 1. If NVD ratings are meaningless to Debian's security team, how does the
> security team prioritize which vulnerability should be fixed first before
> others?

We look at the vulnerabilities and make an assessment.

> 2. According to https://www.debian.org/security/, it states:
> 
> "Debian also participates in security standardization efforts: the Debian
> Security Advisories are CVE-Compatible (review the cross references) and
> Debian is represented in the Board of the Open Vulnerability Assessment
> Language project."
> 
> If Debian Security Advisories are CVE-compatible, it means that the former
> accept the NVD ratings included in CVEs, yes?

We use CVE IDs for mapping vulnerabilities. NVD ratings have about the same
influence to our work as moon phases.

Cheers,
        Moritz

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? te3d4q@sigaint.org - 2016-10-11 17:10 +0200
  Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Mühlenhoff <jmm@inutil.org> - 2016-10-11 17:30 +0200
    Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-11 22:10 +0200
      Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Muehlenhoff <jmm@debian.org> - 2016-10-11 23:10 +0200
        Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-12 12:50 +0200
          Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Michael Stone <mstone@debian.org> - 2016-10-12 17:20 +0200
            Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-13 16:50 +0200
              Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Michael Stone <mstone@debian.org> - 2016-10-13 20:40 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Florian Weimer <fw@deneb.enyo.de> - 2016-10-18 22:30 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? Henrique de Moraes Holschuh <hmh@debian.org> - 2016-10-19 17:00 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Alexander Schreiber <als@thangorodrim.ch> - 2016-10-20 01:00 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? Henrique de Moraes Holschuh <hmh@debian.org> - 2016-10-20 02:40 +0200
          Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Muehlenhoff <jmm@inutil.org> - 2016-10-12 22:40 +0200
            Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-13 16:50 +0200

csiph-web