[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] Buffer Overflow in raptor widely unfixed in Linux distros
From:       Marius Bakke <marius () gnu ! org>
Date:       2020-11-16 19:06:15
Message-ID: 87eekt9l5k.fsf () gnu ! org
[Download RAW message or body]


"David A. Wheeler" <dwheeler@dwheeler.com> writes:

> If you think that CVE assignment is still of "fluctuating reliability" I'd like to \
> hear that argument and get it fixed. It's normally better to fix the standard \
> process for doing something than to create yet another process that runs in \
> parallel. I've seen no recent evidence of this reliability issue.

Speaking as a co-maintainer of an understaffed GNU/Linux distribution
who fixed this back in 2017[0], I preferred the "old days" when free
software security problems were almost always discussed on this list.

While there's no questioning the utility of CVEs in general (Guix can
check the CVE list for any given package with 'guix lint -c cve PKG'),
there are still unresolved CPE mappings, and I don't know how to get
informed of new problems without checking specific (or all) packages.

I tried following the CVE assignment RSS feed initially, but it was not
suitable for human consumption.

How do other distros keep up with new CVE assignments?

[0] https://git.savannah.gnu.org/cgit/guix.git/commit/?id=099c9fdae623e06e4fded8b0d4e55d9d5b56715b



["signature.asc" (application/pgp-signature)]

[prev in list] [next in list] [prev in thread] [next in thread]