0

Two weeks ago I reported a vulnerability to a security mailing list of a large open source software organization. I provided details of how to reproduce the issue and the exact place in the code where the bug causing the vulneratility is. So far I didn't get any response on that yet. I also wrote to one of the main developers asking if he was made aware of the issue. So far there was also no response from him.

The component the vulnerability is about hasn't been released for years, though there is still some developement going on and it is still widely used.

Is it normal for feedback to take that long? What shall I do about it?

Improve this question

1 Answer 1

Reset to default
1

Sometimes you never get any feedback at all. It's just part of the game. It could also be a case of lots of people passing it over as "it's not their job to to look at this issue/component " in fact it's possible that nobody is working on that specific component anymore ..

P.s. I assume you got a cve number and included it with the report ?

Improve this answer
2
  • No, I haven't got a cve number for that issue. Is that important?
    – SpaceTrucker
    Commented Feb 26, 2015 at 7:59
  • Well it's kind of the first step of reporting a security vuln. I am on my iPad at the moment otherwise I would link you to a place to get more information ( Google mitre cve assignment )
    – Damian Nikodem
    Commented Feb 26, 2015 at 12:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .