3 ms·

It's normal that CVEs aren't filled directly after a disclosure. Takes some time till the database gets updated. Not sure how that makes you concerned about re

by hannob 9y ago

It's normal that CVEs aren't filled directly after a disclosure. Takes some time till the database gets updated. Not sure how that makes you concerned about responsible disclosure. As you can read in the bug report the apache security team was informed (actually it was one of their devs figuring out the details of the bug, I just saw it "in the wild", but at first was unable to reproduce it locally). I had also informed the distros mailing list a week in advance. I'm aware responsible disclosure is a weakly defined term, but if you have any concerns that I did something irresponsible I'd like to know.

inetknght 9y ago
In my mind (biased) responsible disclosure includes ensuring that a respected database for tracking security issues has the issue described and publicly available either before or at the same time that a blog publicly discusses it. Otherwise the impression is that the blog is discussing a security issue before it's been addressed by interested parties. That's just my opinion. Whether or not that's the "definition" of responsibility is of course up for discussion.
- patcheudor 9y ago
  I've got two and three year old vulnerabilities I've disclosed which have CVE's which are still not populated. This is very common. No one waits for the CVE to be populated before going public.
  - inetknght 9y ago
    I understand and that's quite unfortunate. Nonetheless, my opinion is my own and I see nothing to change it so far.
    - justinclift 9y ago
      The delay seems like it's caused by the people who update the database just not having the time to get it done. Or alternatively, just not prioritising it for the time they have. Either way of looking at it, delaying release of vuln info to wait for the above to happen seems like it would let vulns keep in-the-wild-and-unknown for much longer. That being said, if you're able to assist with or fix the not-enough-time-to-get-things-done problem, it wouldn't hurt. :)

by hannob 9y ago

inetknght 9y ago

In my mind (biased) responsible disclosure includes ensuring that a respected database for tracking security issues has the issue described and publicly available either before or at the same time that a blog publicly discusses it. Otherwise the impression is that the blog is discussing a security issue before it's been addressed by interested parties. That's just my opinion. Whether or not that's the "definition" of responsibility is of course up for discussion.

patcheudor 9y ago
I've got two and three year old vulnerabilities I've disclosed which have CVE's which are still not populated. This is very common. No one waits for the CVE to be populated before going public.
- inetknght 9y ago
  I understand and that's quite unfortunate. Nonetheless, my opinion is my own and I see nothing to change it so far.
  - justinclift 9y ago
    The delay seems like it's caused by the people who update the database just not having the time to get it done. Or alternatively, just not prioritising it for the time they have. Either way of looking at it, delaying release of vuln info to wait for the above to happen seems like it would let vulns keep in-the-wild-and-unknown for much longer. That being said, if you're able to assist with or fix the not-enough-time-to-get-things-done problem, it wouldn't hurt. :)