[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] Buffer Overflow in raptor widely unfixed in Linux distros
From:       Seth Arnold <seth.arnold () canonical ! com>
Date:       2020-11-16 23:11:42
Message-ID: 20201116231142.GA2956665 () millbarge
[Download RAW message or body]


On Mon, Nov 16, 2020 at 08:06:15PM +0100, Marius Bakke wrote:
> I tried following the CVE assignment RSS feed initially, but it was not
> suitable for human consumption.
>=20
> How do other distros keep up with new CVE assignments?

We (Ubuntu security team) have weekly role rotations among the team. The
person on CVE triage duty will use our tooling to download

https://cve.mitre.org/data/downloads/allitems.xml.gz
https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-recent.json.gz
https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2020.json.gz
https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-2019.json.gz
etc

We also pull from Debian's security team:
https://salsa.debian.org/security-tracker-team/security-tracker.git

We collect CVEs from this list using local mboxes.

We collect CVEs from Red Hat's security announce list:
https://www.redhat.com/archives/rhsa-announce/
and oval feeds:
https://www.redhat.com/security/data/oval/v2/RHEL8/

Having a variety of inputs gives us some resiliency when one or another
service is offline for whatever reason,

I hope this helps.

Thanks

["signature.asc" (application/pgp-signature)]

[prev in list] [next in list] [prev in thread] [next in thread]