Two weeks ago I reported a vulnerability to a security mailing list of a large open source software organization. I provided details of how to reproduce the issue and the exact place in the code where the bug causing the vulneratility is. So far I didn't get any response on that yet. I also wrote to one of the main developers asking if he was made aware of the issue. So far there was also no response from him.

The component the vulnerability is about hasn't been released for years, though there is still some developement going on and it is still widely used.

Is it normal for feedback to take that long? What shall I do about it?


Sometimes you never get any feedback at all. It's just part of the game. It could also be a case of lots of people passing it over as "it's not their job to to look at this issue/component " in fact it's possible that nobody is working on that specific component anymore ..

P.s. I assume you got a cve number and included it with the report ?

  • No, I haven't got a cve number for that issue. Is that important? – SpaceTrucker Feb 26 '15 at 7:59
  • Well it's kind of the first step of reporting a security vuln. I am on my iPad at the moment otherwise I would link you to a place to get more information ( Google mitre cve assignment ) – Damian Nikodem Feb 26 '15 at 12:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.