Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5057

Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

Path csiph.com!2.us.feeder.erje.net!feeder.erje.net!2.eu.feeder.erje.net!news2.arglkargh.de!news.mixmin.net!aioe.org!bofh.it!news.nic.it!robomod
From te3d4q@sigaint.org
Newsgroups linux.debian.security
Subject Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?
Date Wed, 12 Oct 2016 12:50:01 +0200
Message-ID <srpgJ-3eb-11@gated-at.bofh.it> (permalink)
References <sr6QO-8jN-23@gated-at.bofh.it> <sr7a9-8qo-1@gated-at.bofh.it> <srbx7-2Kh-7@gated-at.bofh.it> <srctb-3jq-13@gated-at.bofh.it>
X-Original-To debian-security@lists.debian.org
X-Mailbox-Line From debian-security-request@lists.debian.org Wed Oct 12 10:44:11 2016
Old-Return-Path <te3d4q@sigaint.org>
X-Amavis-Spam-Status No, score=-10.079 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, LDO_WHITELIST=-5, MURPHY_DRUGS_REL8=0.02, RP_MATCHES_RCVD=-3.099] autolearn=ham autolearn_force=no
X-Policyd-Weight using cached result; rate: -6.1
MIME-Version 1.0
Content-Type text/plain;charset=iso-8859-1
Content-Transfer-Encoding 8bit
Importance Normal
X-Mailing-List <debian-security@lists.debian.org> archive/latest/28121
List-ID <debian-security.lists.debian.org>
List-URL <https://lists.debian.org/debian-security/>
List-Archive https://lists.debian.org/msgid-search/3cce61b9eed05dfe180e771e638706ca.webmail@localhost
Approved robomod@news.nic.it
Lines 17
Organization linux.* mail to news gateway
Sender robomod@news.nic.it
X-Original-Cc "Moritz Muehlenhoff" <jmm@debian.org>
X-Original-Date Wed, 12 Oct 2016 10:43:41 -0000
X-Original-Message-ID <3cce61b9eed05dfe180e771e638706ca.webmail@localhost>
X-Original-References <eae7d98cc7550642774010d3fa7fdfb4.webmail@localhost> <slrnnvq0pp.grj.jmm@inutil.org> <e13649a450ef6829f1f4d38cd6051e8d.webmail@localhost> <20161011210128.GA22554@inutil.org>
Xref csiph.com linux.debian.security:5057

Show key headers only | View raw

> We look at the vulnerabilities and make an assessment.
> Cheers,
>         Moritz
>

1. If I understood correctly the contents of your reply, on what basis
does the Debian security team assess the severity of each security
vulnerability? What are those criteria?

2. Your latest reply implies strongly the possibility of the Debian
security team's assessments of security vulnerabilities differing from
those of the security teams of other popular Linux distros such as Gentoo,
Kali, ArchLinux, Ubuntu, etc. Am I correct?

As an example, ArchLinux issues a patch for a security vulnerability
CVE-2016-xyz with an NVD rating of medium risk. However the Debian
security team does not issue a fix for it.

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? te3d4q@sigaint.org - 2016-10-11 17:10 +0200
  Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Mühlenhoff <jmm@inutil.org> - 2016-10-11 17:30 +0200
    Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-11 22:10 +0200
      Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Muehlenhoff <jmm@debian.org> - 2016-10-11 23:10 +0200
        Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-12 12:50 +0200
          Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Michael Stone <mstone@debian.org> - 2016-10-12 17:20 +0200
            Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-13 16:50 +0200
              Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Michael Stone <mstone@debian.org> - 2016-10-13 20:40 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Florian Weimer <fw@deneb.enyo.de> - 2016-10-18 22:30 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? Henrique de Moraes Holschuh <hmh@debian.org> - 2016-10-19 17:00 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Alexander Schreiber <als@thangorodrim.ch> - 2016-10-20 01:00 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? Henrique de Moraes Holschuh <hmh@debian.org> - 2016-10-20 02:40 +0200
          Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Muehlenhoff <jmm@inutil.org> - 2016-10-12 22:40 +0200
            Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-13 16:50 +0200

csiph-web