[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] Re: CVE request: Asterisk AST-2013-007
From:       cve-assign () mitre ! org
Date:       2013-12-20 15:38:11
Message-ID: 201312201538.rBKFcBQI021587 () linus ! mitre ! org
[Download RAW message or body]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

> But an ID is missing for
> http://downloads.asterisk.org/pub/security/AST-2013-007.html

It is missing because that disclosure does not qualify for a CVE ID.
The rationale sent to upstream was:

'We don't think we'll be able to assign a CVE number for the
downloads.asterisk.org/pub/security/AST-2013-007.html announcement. As
far as we can tell, the announcement is about introducing an optional
new security feature. An example of a type of issue that could have a
CVE assignment is: ... a third party ships a product based on
Asterisk ... this product implements an external control protocol that
is capable of calling the SHELL and FILE functions with untrusted user
input ... the third party publishes a security announcement stating
that the new release of their product ships with a revised
asterisk.conf containing a "no" value for the "live_dangerously"
option, in order to fix this vulnerability ... We would generally
assign one CVE number for each such security announcement, if any are
found.'

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJStGRFAAoJEKllVAevmvmsT7sH/jG+t0zvQPHnDdQNWzta/dOX
v+qoi1ej0V8NYNflNY5A7SPNGtCJrvsCewyYwprZ04tEiFhPV5SwgF6YbMOIGPFl
6dJA6oyu4Hyl7+28Snacesi1xh5F7oBaRA+uBdTfVeKTXC8OacfsfCQSXdjWWFbV
Hi/JY4cjRJIZEQLEOGxxIka8E3nnpKhz0+CkQKqGeVAZLEN2wsiZpaYUFKtg6DIx
VbDF+GoX8MNK4ueKcuDDw3CRTGbnC5mpc1zJXrvaKLQWh607VrWzxBMoIGycpGFR
EhIjmKL0nD0IoplbSZrU0KDSMZSzO9ZOA10HgUncI1L5+jFRCHkQlTjtxT7yHgk=
=zlC7
-----END PGP SIGNATURE-----
[prev in list] [next in list] [prev in thread] [next in thread]