Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5055

Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?

From te3d4q@sigaint.org
Newsgroups linux.debian.security
Subject Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct?
Date 2016-10-11 22:10 +0200
Message-ID <srbx7-2Kh-7@gated-at.bofh.it> (permalink)
References <sr6QO-8jN-23@gated-at.bofh.it> <sr7a9-8qo-1@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

> No, the NVD ratings are entirely meaningless to us. In addition to
> security
> issues fixed in DSAs, there are also minor security fixes provided via
> the jessie point updates.
>
> Cheers,
>         Moritz

1. If NVD ratings are meaningless to Debian's security team, how does the
security team prioritize which vulnerability should be fixed first before
others?

2. According to https://www.debian.org/security/, it states:

"Debian also participates in security standardization efforts: the Debian
Security Advisories are CVE-Compatible (review the cross references) and
Debian is represented in the Board of the Open Vulnerability Assessment
Language project."

If Debian Security Advisories are CVE-compatible, it means that the former
accept the NVD ratings included in CVEs, yes?

Back to linux.debian.security | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? te3d4q@sigaint.org - 2016-10-11 17:10 +0200
  Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Mühlenhoff <jmm@inutil.org> - 2016-10-11 17:30 +0200
    Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-11 22:10 +0200
      Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Muehlenhoff <jmm@debian.org> - 2016-10-11 23:10 +0200
        Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-12 12:50 +0200
          Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Michael Stone <mstone@debian.org> - 2016-10-12 17:20 +0200
            Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-13 16:50 +0200
              Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Michael Stone <mstone@debian.org> - 2016-10-13 20:40 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by Debian security team, is that correct? Florian Weimer <fw@deneb.enyo.de> - 2016-10-18 22:30 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? Henrique de Moraes Holschuh <hmh@debian.org> - 2016-10-19 17:00 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Alexander Schreiber <als@thangorodrim.ch> - 2016-10-20 01:00 +0200
                Re: Vulnerabilities rated medium or low risk may not be fixed by Debian  security team, is that correct? Henrique de Moraes Holschuh <hmh@debian.org> - 2016-10-20 02:40 +0200
          Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? Moritz Muehlenhoff <jmm@inutil.org> - 2016-10-12 22:40 +0200
            Re: Vulnerabilities rated medium or low risk may not be fixed by  Debian security team, is that correct? te3d4q@sigaint.org - 2016-10-13 16:50 +0200

csiph-web