Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #4629

Re: tracking security issues without CVEs

Show all headers | View raw

Salvatore Bonaccorso <carnil@debian.org> writes:

> Creating individual bugs in the Debian BTS, including more details
> like fixing commits would be a great start, since we use either CVEs
> or references to the Debian BTS in DSAs (and DLAs). Furthermore the
> security-tracker handles both (you can actually search items there via
> either CVE id, bug number or package name).

The problem with this (if I understand security tracker as well as I
think I do), if we want to track them using security-tracker, you need
an entry in data/CVE/list. If there is no CVE that means you have to use
CVE-2016-XXXX. Which in turn means that data/DSA/list and data/DLA/list
can't directly refer to the data/CVE/list entry being fixed.

I also seem to recall (???) that CVE-2016-XXXX is intended for when a
CVE is expected very soon.

So if you want to get a good idea of where we have fixed #692367, and
what DSA/DLA were involved, I don't think there is a good way of adding
this information to security-tracker.


> The original CVE request at
> http://www.openwall.com/lists/oss-security/2014/12/24/1 was IMHO not
> fully optimal, since it just pasted a collection of items. Adding
> references to fixing commits would have helped to get CVEs assigned to
> issues.  The original request at least makes it really hard to
> identify the issues and make sure the CVEs are assigned correctly.

Yes, I thought this was lousy too. There is a reference to a list of
patches, however no easy way of being able to link each issue to each
patch. So if a CVE was provided for each issue, it would be relatively
hard to link it to the appropriate patch with 100% certainty.

With so many different issues, I suspect it is going to be overwhelming
requesting a CVE for each issue no matter what you do.
-- 
Brian May <bam@debian.org>

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

tracking security issues without CVEs Brian May <brian@linuxpenguins.xyz> - 2016-03-06 05:40 +0100
  Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-03-06 16:10 +0100
  Re: tracking security issues without CVEs Salvatore Bonaccorso <carnil@debian.org> - 2016-03-06 17:10 +0100
    Re: tracking security issues without CVEs Salvatore Bonaccorso <carnil@debian.org> - 2016-03-06 19:00 +0100
      Re: tracking security issues without CVEs Brian May <bam@debian.org> - 2016-03-06 23:40 +0100
      Re: tracking security issues without CVEs Moritz Mühlenhoff <jmm@inutil.org> - 2016-03-10 21:00 +0100
        Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-03-11 01:30 +0100
    Re: tracking security issues without CVEs Brian May <bam@debian.org> - 2016-03-06 23:40 +0100
  Re: tracking security issues without CVEs Kurt Roeckx <kurt@roeckx.be> - 2016-03-12 16:00 +0100
    Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-03-13 14:00 +0100
      Re: tracking security issues without CVEs Antoine Beaupré <anarcat@orangeseeds.org> - 2016-03-22 15:30 +0100
        Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-03-23 04:10 +0100
          Re: tracking security issues without CVEs Michael Stone <mstone@debian.org> - 2016-03-23 20:10 +0100
            Re: tracking security issues without CVEs Andrew Deck <andrew.hastings.deck@gmail.com> - 2016-03-28 16:40 +0200
              Re: tracking security issues without CVEs Paul Wise <pabs@debian.org> - 2016-04-28 08:30 +0200

csiph-web