Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4625

Re: tracking security issues without CVEs

Show all headers | View raw

Hi,

On Sun, Mar 06, 2016 at 03:33:16PM +1100, Brian May wrote:
> Just wondering if there is some other way we can track security issues
> for when CVEs are not available.
> 
> Thinking of imagemagick here, it has a lot of security issues, and
> requests for CVEs are not getting any responses.

Creating individual bugs in the Debian BTS, including more details
like fixing commits would be a great start, since we use either CVEs
or references to the Debian BTS in DSAs (and DLAs). Furthermore the
security-tracker handles both (you can actually search items there via
either CVE id, bug number or package name).

The original CVE request at
http://www.openwall.com/lists/oss-security/2014/12/24/1 was IMHO not
fully optimal, since it just pasted a collection of items. Adding
references to fixing commits would have helped to get CVEs assigned to
issues.  The original request at least makes it really hard to
identify the issues and make sure the CVEs are assigned correctly.

Regards,
Salvatore

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

tracking security issues without CVEs Brian May <brian@linuxpenguins.xyz> - 2016-03-06 05:40 +0100
  Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-03-06 16:10 +0100
  Re: tracking security issues without CVEs Salvatore Bonaccorso <carnil@debian.org> - 2016-03-06 17:10 +0100
    Re: tracking security issues without CVEs Salvatore Bonaccorso <carnil@debian.org> - 2016-03-06 19:00 +0100
      Re: tracking security issues without CVEs Brian May <bam@debian.org> - 2016-03-06 23:40 +0100
      Re: tracking security issues without CVEs Moritz Mühlenhoff <jmm@inutil.org> - 2016-03-10 21:00 +0100
        Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-03-11 01:30 +0100
    Re: tracking security issues without CVEs Brian May <bam@debian.org> - 2016-03-06 23:40 +0100
  Re: tracking security issues without CVEs Kurt Roeckx <kurt@roeckx.be> - 2016-03-12 16:00 +0100
    Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-03-13 14:00 +0100
      Re: tracking security issues without CVEs Antoine Beaupré <anarcat@orangeseeds.org> - 2016-03-22 15:30 +0100
        Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-03-23 04:10 +0100
          Re: tracking security issues without CVEs Michael Stone <mstone@debian.org> - 2016-03-23 20:10 +0100
            Re: tracking security issues without CVEs Andrew Deck <andrew.hastings.deck@gmail.com> - 2016-03-28 16:40 +0200
              Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-04-28 08:30 +0200

csiph-web