Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5053 > unrolled thread

Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

Back to article view | Back to linux.debian.security

Contents

  Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? te3d4q@sigaint.org - 2016-10-11 17:10 +0200
    Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Mühlenhoff <jmm@inutil.org> - 2016-10-11 17:30 +0200
      Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-11 22:10 +0200
        Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Muehlenhoff <jmm@debian.org> - 2016-10-11 23:10 +0200
          Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-12 12:50 +0200
            Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Michael Stone <mstone@debian.org> - 2016-10-12 17:20 +0200
              Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-13 16:50 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Michael Stone <mstone@debian.org> - 2016-10-13 20:40 +0200
                  Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Florian Weimer <fw@deneb.enyo.de> - 2016-10-18 22:30 +0200
                    Re: Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? Henrique de Moraes Holschuh <hmh@debian.org> - 2016-10-19 17:00 +0200
                      Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Alexander Schreiber <als@thangorodrim.ch> - 2016-10-20 01:00 +0200
                        Re: Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? Henrique de Moraes Holschuh <hmh@debian.org> - 2016-10-20 02:40 +0200
            Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Muehlenhoff <jmm@inutil.org> - 2016-10-12 22:40 +0200
              Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-13 16:50 +0200

#5053 — Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

I read somewhere on a forum that for security vulnerabilities that have
"NVD security" ratings of medium or low risk, Debian's security team may
not issue patches/fixes for them. Only high-risk security vulnerabilities
will be fixed. Is that correct?

I was under the impression that all security vulnerabilities of whatever
their risk ratings will be fixed.

If you are a member of or know someone who is on Debian's security team,
please clarify ask them to clarify it for me. Thanks.

[toc] | [next] | [standalone]

#5054 — Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

te3d4q@sigaint.org <te3d4q@sigaint.org> schrieb:
> I read somewhere on a forum that for security vulnerabilities that have
> "NVD security" ratings of medium or low risk, Debian's security team may
> not issue patches/fixes for them. Only high-risk security vulnerabilities
> will be fixed. Is that correct?

No, the NVD ratings are entirely meaningless to us. In addition to security
issues fixed in DSAs, there are also minor security fixes provided via
the jessie point updates.

Cheers,
        Moritz

[toc] | [prev] | [next] | [standalone]

#5055 — Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

> No, the NVD ratings are entirely meaningless to us. In addition to
> security
> issues fixed in DSAs, there are also minor security fixes provided via
> the jessie point updates.
>
> Cheers,
>         Moritz

1. If NVD ratings are meaningless to Debian's security team, how does the
security team prioritize which vulnerability should be fixed first before
others?

2. According to https://www.debian.org/security/, it states:

"Debian also participates in security standardization efforts: the Debian
Security Advisories are CVE-Compatible (review the cross references) and
Debian is represented in the Board of the Open Vulnerability Assessment
Language project."

If Debian Security Advisories are CVE-compatible, it means that the former
accept the NVD ratings included in CVEs, yes?

[toc] | [prev] | [next] | [standalone]

#5056 — Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

On Tue, Oct 11, 2016 at 08:04:33PM -0000, te3d4q@sigaint.org wrote:
> 1. If NVD ratings are meaningless to Debian's security team, how does the
> security team prioritize which vulnerability should be fixed first before
> others?

We look at the vulnerabilities and make an assessment.

> 2. According to https://www.debian.org/security/, it states:
> 
> "Debian also participates in security standardization efforts: the Debian
> Security Advisories are CVE-Compatible (review the cross references) and
> Debian is represented in the Board of the Open Vulnerability Assessment
> Language project."
> 
> If Debian Security Advisories are CVE-compatible, it means that the former
> accept the NVD ratings included in CVEs, yes?

We use CVE IDs for mapping vulnerabilities. NVD ratings have about the same
influence to our work as moon phases.

Cheers,
        Moritz

[toc] | [prev] | [next] | [standalone]

#5057 — Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

> We look at the vulnerabilities and make an assessment.
> Cheers,
>         Moritz
>

1. If I understood correctly the contents of your reply, on what basis
does the Debian security team assess the severity of each security
vulnerability? What are those criteria?

2. Your latest reply implies strongly the possibility of the Debian
security team's assessments of security vulnerabilities differing from
those of the security teams of other popular Linux distros such as Gentoo,
Kali, ArchLinux, Ubuntu, etc. Am I correct?

As an example, ArchLinux issues a patch for a security vulnerability
CVE-2016-xyz with an NVD rating of medium risk. However the Debian
security team does not issue a fix for it.

[toc] | [prev] | [next] | [standalone]

#5058 — Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

On Wed, Oct 12, 2016 at 10:43:41AM -0000, te3d4q@sigaint.org wrote:
>1. If I understood correctly the contents of your reply, on what basis
>does the Debian security team assess the severity of each security
>vulnerability? What are those criteria?

You'll find that there's a lot of criticism of CVSS in the industry, and 
that a real CVSS number depends heavily on temporal and environmental 
factors which aren't reflected in the NVD baseline. It's not 
particularly uncommon for base scores to be overinflated given 
configuration specifics, or to understate the importance of 
vulnerabilities being actively exploited. Relying soley on base scores 
to prioritize actions without considering the environmental or temporal 
factors is a mistake per the guidelines on how to use CVSS.

>2. Your latest reply implies strongly the possibility of the Debian
>security team's assessments of security vulnerabilities differing from
>those of the security teams of other popular Linux distros such as Gentoo,
>Kali, ArchLinux, Ubuntu, etc. Am I correct?

You'll find that no vendor uses CVSS base scores in NVD to strictly 
prioritize their work.

>As an example, ArchLinux issues a patch for a security vulnerability
>CVE-2016-xyz with an NVD rating of medium risk. However the Debian
>security team does not issue a fix for it.

To have an example, you'd need specifics. This is a hypothetical without 
a question. If the implicit question is "could this happen" the answer 
is yes, but you'd need to discuss a specific case to find out why.

Mike Stone

[toc] | [prev] | [next] | [standalone]

#5061 — Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

>
> To have an example, you'd need specifics. This is a hypothetical without
> a question. If the implicit question is "could this happen" the answer
> is yes, but you'd need to discuss a specific case to find out why.
>
> Mike Stone

As you asked me for a specific case, may I bring up CVE-2016-5696.

A fix to the medium-risk vulnerability was uploaded on July 10, 2016 by
Eric Dumazet (cf.
https://github.com/torvalds/linux/commit/75ff39ccc1bd5d3c455b6822ab09e533c551f758)

Ben Hutchings uploaded his work on the fix on August 12, 2016 (cf.
https://anonscm.debian.org/cgit/kernel/linux.git/log/?h=jessie-security)

Debian officially pushed out the fix on September 4, 2016 via DSA-3659-1.

Are there reasons for the 23-day delay in providing end-users the patch?

To the best of my knowledge, Ubuntu advised its end-users on how to fix
the vulnerability way before Debian did.

[toc] | [prev] | [next] | [standalone]

#5062 — Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

On Thu, Oct 13, 2016 at 02:45:29PM -0000, te3d4q@sigaint.org wrote:
>As you asked me for a specific case, may I bring up CVE-2016-5696.
>
>A fix to the medium-risk vulnerability was uploaded on July 10, 2016 by
>Eric Dumazet (cf.
>https://github.com/torvalds/linux/commit/75ff39ccc1bd5d3c455b6822ab09e533c551f758)
>
>Ben Hutchings uploaded his work on the fix on August 12, 2016 (cf.
>https://anonscm.debian.org/cgit/kernel/linux.git/log/?h=jessie-security)
>
>Debian officially pushed out the fix on September 4, 2016 via DSA-3659-1.
>
>Are there reasons for the 23-day delay in providing end-users the patch?

I don't know the specifics of this one but kernel updates are generally 
kind of a mess and in this case we're talking about an issue that 
basically boils down to a DoS for internet-facing hosts and for which 
there existed a mitigation. I'm personally not too concerned about the 
timeline. 

Mike Stone

[toc] | [prev] | [next] | [standalone]

#5063 — Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

* Michael Stone:

> On Thu, Oct 13, 2016 at 02:45:29PM -0000, te3d4q@sigaint.org wrote:
>>As you asked me for a specific case, may I bring up CVE-2016-5696.
>>
>>A fix to the medium-risk vulnerability was uploaded on July 10, 2016 by
>>Eric Dumazet (cf.
>>https://github.com/torvalds/linux/commit/75ff39ccc1bd5d3c455b6822ab09e533c551f758)
>>
>>Ben Hutchings uploaded his work on the fix on August 12, 2016 (cf.
>>https://anonscm.debian.org/cgit/kernel/linux.git/log/?h=jessie-security)
>>
>>Debian officially pushed out the fix on September 4, 2016 via DSA-3659-1.
>>
>>Are there reasons for the 23-day delay in providing end-users the patch?
>
> I don't know the specifics of this one but kernel updates are
> generally kind of a mess and in this case we're talking about an issue
> that basically boils down to a DoS for internet-facing hosts and for
> which there existed a mitigation. I'm personally not too concerned
> about the timeline. 

Right.  Debian kernel updates can only be applied with a reboot.  If
we publish a kernel update, its mere availability may put some of our
users out of compliance with their policies, which is why we batch
these updates.

[toc] | [prev] | [next] | [standalone]

#5064

On Tue, Oct 18, 2016, at 18:21, Florian Weimer wrote:
> Right.  Debian kernel updates can only be applied with a reboot.  If
> we publish a kernel update, its mere availability may put some of our
> users out of compliance with their policies, which is why we batch
> these updates.

Is this correct?  Really?

-- 
  Henrique de Moraes Holschuh <hmh@debian.org>

[toc] | [prev] | [next] | [standalone]

#5065 — Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

On Wed, Oct 19, 2016 at 12:51:06PM -0200, Henrique de Moraes Holschuh wrote:
> On Tue, Oct 18, 2016, at 18:21, Florian Weimer wrote:
> > Right.  Debian kernel updates can only be applied with a reboot.  If
> > we publish a kernel update, its mere availability may put some of our
> > users out of compliance with their policies, which is why we batch
> > these updates.
> 
> Is this correct?  Really?

Well, in certain environments I would not be surprised by a security policy
that boils down to: "If a security patch from [authorized source] becomes
available, it must be applied to all applicable systems within [short time]."

Kind regards,
           Alex.
-- 
"Opportunity is missed by most people because it is dressed in overalls and
 looks like work."                                      -- Thomas A. Edison

[toc] | [prev] | [next] | [standalone]

#5066

On Wed, Oct 19, 2016, at 20:32, Alexander Schreiber wrote:
> On Wed, Oct 19, 2016 at 12:51:06PM -0200, Henrique de Moraes Holschuh
> wrote:
> > On Tue, Oct 18, 2016, at 18:21, Florian Weimer wrote:
> > > Right.  Debian kernel updates can only be applied with a reboot.  If
> > > we publish a kernel update, its mere availability may put some of our
> > > users out of compliance with their policies, which is why we batch
> > > these updates.
> > 
> > Is this correct?  Really?
> 
> Well, in certain environments I would not be surprised by a security
> policy
> that boils down to: "If a security patch from [authorized source] becomes
> available, it must be applied to all applicable systems within [short
> time]."

I was asking about the kernel team's policy.

I could care less for the policies of "certain environments", they are
NOT likely to be a problem: any remotely sane site with a policy that
enforces a deadline to install security updates (including reboots) will
also have policies on scheduling the required maintenance window for
such updates, *including* what to do when the maintenance window can't
be scheduled to avoid SLA violations.  And that's for environments where
you can't just do staggered updates, taking a set of nodes offline to
update and regression-test, and bring them back to production (or
rollback/abort the update should a regression be detected) without much
(if any) impact to services.

-- 
  Henrique de Moraes Holschuh <hmh@debian.org>

[toc] | [prev] | [next] | [standalone]

#5059 — Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

On Wed, Oct 12, 2016 at 10:43:41AM -0000, te3d4q@sigaint.org wrote:
> > We look at the vulnerabilities and make an assessment.
> > Cheers,
> >         Moritz
> >
> 
> 1. If I understood correctly the contents of your reply, on what basis
> does the Debian security team assess the severity of each security
> vulnerability? What are those criteria?

Human judgement based on experience.
 
> 2. Your latest reply implies strongly the possibility of the Debian
> security team's assessments of security vulnerabilities differing from
> those of the security teams of other popular Linux distros such as Gentoo,
> Kali, ArchLinux, Ubuntu, etc. Am I correct?

Of course, every distribution makes their own assessment. After 
all each distro might ship an affected codebase in different 
versions/configs/environments.

Cheers,
        Moritz

[toc] | [prev] | [next] | [standalone]

#5060 — Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

> Of course, every distribution makes their own assessment. After
> all each distro might ship an affected codebase in different
> versions/configs/environments.
>
> Cheers,
>         Moritz
>

Hi Moritz

I appreciate the time and effort that you spent on clarifying my questions.

Thank you.

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web