oss-sec mailing list archives
Re: vulnerable version: 4.8.12 and previous versions but xml file says: cpe:/o:linux:linux_kernel:4.8.12"/>
From: Kurt Seifried <kseifried () redhat com>
Date: Fri, 16 Dec 2016 10:50:00 -0700
On Wed, Dec 14, 2016 at 11:57 AM, Sona Sarmadi <sona.sarmadi () enea com> wrote:On 2016-12-14 15:26, Kurt Seifried wrote:Why are you complaining about a nist.gov website/data on an opensource security mailing list/to MITRE? (hint: we can't fix it and neither can MITRE) Please contact NIST.Thanks for being so helpful. I was just trying to see of there are other people out there who also think this is a problem. This list seemed like a place where I could find such people. Perhaps someone knows a work around, perhaps some post-processing tool. If none exists, I guess we have to try to fix the problem at the source or use another CVE databse. Cheers //SonaOn Wed, Dec 14, 2016 at 1:19 AM, Sona Sarmadi <sona.sarmadi () enea com>wrote:Hi all, It seems that nvd.xml files (e.g. nvdcve-2.0-2016.xml) does not list vulnerable versions correctly. One example is the following CVE.Vulnerable
So I've been thinking about the question here (and several other recent postings) and my response (less than ideal, and unnecessarily grumpy for which I apologize). Here are my assumptions: 1) We (infosec, technology, basically everyone) needs better context sensitive help/guidance. Obviously this won't happen globally so 2) We (infosec, technology, basically everyone) needs better public documentation on things that people ask, for example the CVE "***RESERVED*** description question I got so often I updated the CVE Wikipedia entry, searchability and SEO ranking is an issue here (what good are docs if google/bing/etc don't show them to people asking questions?) 3) We do have a number of specific sites we should probably target to include the information (Wikipedia, StackExchange sites, etc.) 4) We definitely have a number of sites where people ask questions (this list, Reddit, etc.) This feeds into my CVE Mentor idea, we need people that can easily be discovered and either know the answers, know where to find the answer, or know who to ask/further direct people to for help. But we need it more generally than just for CVE. Now, I suspect many of my assumptions are wrong/out dated. So I would appreciate if people would give feedback (where do you go for security info? instagram?) I would appreciate that. -- Kurt Seifried -- Red Hat -- Product Security -- Cloud PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 Red Hat Product Security contact: secalert () redhat com
Current thread:
- vulnerable version: 4.8.12 and previous versions but xml file says: cpe:/o:linux:linux_kernel:4.8.12"/> Sona Sarmadi (Dec 14)
- Re: vulnerable version: 4.8.12 and previous versions but xml file says: cpe:/o:linux:linux_kernel:4.8.12"/> Kurt Seifried (Dec 14)
- Re: vulnerable version: 4.8.12 and previous versions but xml file says: cpe:/o:linux:linux_kernel:4.8.12"/> Sona Sarmadi (Dec 14)
- Re: vulnerable version: 4.8.12 and previous versions but xml file says: cpe:/o:linux:linux_kernel:4.8.12"/> Kurt Seifried (Dec 14)
- Re: vulnerable version: 4.8.12 and previous versions but xml file says: cpe:/o:linux:linux_kernel:4.8.12"/> Kurt Seifried (Dec 16)
- Re: vulnerable version: 4.8.12 and previous versions but xml file says: cpe:/o:linux:linux_kernel:4.8.12"/> Sona Sarmadi (Dec 14)
- Re: vulnerable version: 4.8.12 and previous versions but xml file says: cpe:/o:linux:linux_kernel:4.8.12"/> Kurt Seifried (Dec 14)