Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #6525 > unrolled thread

Reporting CVE as fixed back to authority

Back to article view | Back to linux.debian.security

Contents

  Reporting CVE as fixed back to authority Alexandru Mihail <alexandru.mihail2897@gmail.com> - 2026-09-09 11:00 +0200
    Re: Reporting CVE as fixed back to authority Salvatore Bonaccorso <carnil@debian.org> - 2026-09-10 06:40 +0200
      Re: Reporting CVE as fixed back to authority Daniel Leidert <daniel.leidert@wgdd.de> - 2026-09-10 07:40 +0200

#6525 — Reporting CVE as fixed back to authority

[Multipart message — attachments visible in raw view] — view raw

Hello, I've recently fixed a CVE reported in mini-httpd, which I solely 
maintain.

CVE-2026-68005

https://nvd.nist.gov/vuln/detail/cve-2026-68005

This was fixed in: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144953

The problem is, the official CVE looks at upstream for changes, as it 
should. Upstream is most probably dead, hasn't responded in a long 
while, I am effectively the upstream maintaining this.

How do I/Debian propagate the information that the CVE was fixed ? I 
don't think this will happen automatically, since upstream won't respond 
to my forwarded patches, although I will send them.

All users still using the server are using the Debian codebase, or 
derivatives.


Thanks,

Alexandru Mihail

[toc] | [next] | [standalone]

#6526

Hi Alexandru,

On Wed, Sep 09, 2026 at 11:50:37AM +0300, Alexandru Mihail wrote:
> Hello, I've recently fixed a CVE reported in mini-httpd, which I solely
> maintain.
> 
> CVE-2026-68005
> 
> https://nvd.nist.gov/vuln/detail/cve-2026-68005
> 
> This was fixed in: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1144953
> 
> The problem is, the official CVE looks at upstream for changes, as it
> should. Upstream is most probably dead, hasn't responded in a long while, I
> am effectively the upstream maintaining this.
> 
> How do I/Debian propagate the information that the CVE was fixed ? I don't
> think this will happen automatically, since upstream won't respond to my
> forwarded patches, although I will send them.
> 
> All users still using the server are using the Debian codebase, or
> derivatives.

I'm not completely sure if I understand what you are aiming for. In
Debian itself we track it as
https://security-tracker.debian.org/tracker/CVE-2026-68005

I assume you wanted to add a note that in Debian the CVE is referenced
by https://bugs.debian.org/1144953 ? Then you can via
https://cveform.mitre.org ask to update references and add a reference
to the Debian bug as well.

Does this help?

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#6528

Am Donnerstag, dem 10.09.2026 um 06:35 +0200 schrieb Salvatore
Bonaccorso:
> On Wed, Sep 09, 2026 at 11:50:37AM +0300, Alexandru Mihail wrote:

[..]
> > All users still using the server are using the Debian codebase, or
> > derivatives.
> 
> I'm not completely sure if I understand what you are aiming for. In
> Debian itself we track it as
> https://security-tracker.debian.org/tracker/CVE-2026-68005
> 
> I assume you wanted to add a note that in Debian the CVE is referenced
> by https://bugs.debian.org/1144953 ? Then you can via
> https://cveform.mitre.org ask to update references and add a reference
> to the Debian bug as well.

My understanding is that the OP states that the Debian package source
is the de-facto "upstream" source for anybody still using this software
and they seek advice on how to add information to the original CVE that
the issue has been fixed.

Regards, Daniel

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web