Tag Info

New answers tagged

0

As part of building the CVE, MITRE developed in 2005 a preliminary classification and categorization of vulnerabilities, attacks, faults, and other concepts to generalize the CVE into common software weaknesses. However, while sufficient for CVE, those groupings were too rough to be used to identify and categorize the functionality offered by the code ...


8

It's because the vulnerability was actually first discovered in 2010 (even if it wasn't reported as a security issue back then, just as a bug), and rediscovered again in 2014 by Ted Unangst after heartbleed became the straw that broke the camel back, and this time correctly identified as an issue with security implications. Original bug report : ...


1

You can request a CVE number without the details being published. The timeline I have previously followed is: Notify vendor Request CVE number, while waiting for vendor response Publish advisory, once issue is fixed or a certain amount of time has passed I consider the CVE guys reasonably trustworthy, and I will disclose high-level details of the ...


1

If you apply for a CVE ID and are granted one, then the vulnerability will become public knowledge. It is recommended that you first contact the software developer and wait 30 days for their response. Depending on the severity of the vulnerability, they may ask that you do not make the vulnerability known to the public until they have had time to patch. ...


0

As far as I know, you first contact the vendor. There are numerous CVE requests on the oss-security mailing list pointing to bug trackers. Of course if a vendor ignores the issue that's a different story... I suspect your question has more to do with whether it's ethical to disclose without warning a vendor?



Top 50 recent answers are included