3 ms·

CVE no. was created in July. I wonder whether the fix took that long.

by bureaucrat 7y ago

nwrk 7y ago
Good eye and yes
tambre 7y ago
CVEs are typically reserved in blocks by big organizations.
- skunkpocalypse 7y ago
  In a certain sense that's kinda sad.
Buge 7y ago
The CVE number was reserved in July[1]. That doesn't mean the vulnerability was found in July. The vulnerability was reported to Google October 29[2], so between report to fix roll out was only ~2 days. Although the bug tracker entry is hidden[3], you can deduce the time the entry was created by iterating over bug IDs, which indicates it was filed between 8:56 AM PDT[4] and 9:11 AM PDT[5]. The fix was sent for review Oct 29 4:29 PM PDT and submitted at 5:47 PM[6]. It was cherrypicked Oct 30 at 9:51 AM[7]. >Date Entry Created > 20190718 > Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-13720 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-13720 [2] https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_31.html https://chromereleases.googleblog.com/2019/10/stable-channel... [3] https://bugs.chromium.org/p/chromium/issues/detail?id=1019226 https://bugs.chromium.org/p/chromium/issues/detail?id=101922... [4] https://bugs.chromium.org/p/chromium/issues/detail?id=1019223 https://bugs.chromium.org/p/chromium/issues/detail?id=101922... [5] https://bugs.chromium.org/p/chromium/issues/detail?id=1019228 https://bugs.chromium.org/p/chromium/issues/detail?id=101922... [6] https://chromium-review.googlesource.com/c/chromium/src/+/1888103 https://chromium-review.googlesource.com/c/chromium/src/+/18... [7] https://chromium.googlesource.com/chromium/src/+/f1b501721e521a900c37b4f8cce4be8baedae731 https://chromium.googlesource.com/chromium/src/+/f1b501721e5...

CVE no. was created in July. I wonder whether the fix took that long.

nwrk 7y ago

Good eye and yes

tambre 7y ago

CVEs are typically reserved in blocks by big organizations.

skunkpocalypse 7y ago
In a certain sense that's kinda sad.

Buge 7y ago

The CVE number was reserved in July[1]. That doesn't mean the vulnerability was found in July. The vulnerability was reported to Google October 29[2], so between report to fix roll out was only ~2 days. Although the bug tracker entry is hidden[3], you can deduce the time the entry was created by iterating over bug IDs, which indicates it was filed between 8:56 AM PDT[4] and 9:11 AM PDT[5]. The fix was sent for review Oct 29 4:29 PM PDT and submitted at 5:47 PM[6]. It was cherrypicked Oct 30 at 9:51 AM[7]. >Date Entry Created > 20190718 > Disclaimer: The entry creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE. [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-13720 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2019-13720 [2] https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_31.html https://chromereleases.googleblog.com/2019/10/stable-channel... [3] https://bugs.chromium.org/p/chromium/issues/detail?id=1019226 https://bugs.chromium.org/p/chromium/issues/detail?id=101922... [4] https://bugs.chromium.org/p/chromium/issues/detail?id=1019223 https://bugs.chromium.org/p/chromium/issues/detail?id=101922... [5] https://bugs.chromium.org/p/chromium/issues/detail?id=1019228 https://bugs.chromium.org/p/chromium/issues/detail?id=101922... [6] https://chromium-review.googlesource.com/c/chromium/src/+/1888103 https://chromium-review.googlesource.com/c/chromium/src/+/18... [7] https://chromium.googlesource.com/chromium/src/+/f1b501721e521a900c37b4f8cce4be8baedae731 https://chromium.googlesource.com/chromium/src/+/f1b501721e5...