RE: OS command injection vulnerability in Chicken Scheme

["Christey, Steven M." <coley () mitre org>]

Despite popular perception, the presence of useful details does not necessarily get CVEs published more quickly 
(although missing or conflicting details certainly make things worse, and poorly-written advisories can reduce overall 
throughput).  We have particular description styles and analytical requirements that are not visible to the general 
public.  We have a process where we actively monitor public sources including oss-security, and we prioritize which CVE 
entries are published first.  Priorities are currently guided by
http://cve.mitre.org/data/board/archives/2012-09/msg00000.html, but other disclosures are certainly considered as well.

We are currently focused on working with the CVE Editorial Board on extending the CVE ID syntax to handle more than 
10,000 vulnerabilities per year, and we are also training several new hires.  We expect our output to rise noticeably 
within a few months, and we will continue to refine our analysis and publication processes to improve our production in 
a way that balances the needs of CVE's many diverse users.

- Steve


> -----Original Message-----
> From: Peter Bex [mailto:Peter.Bex () xs4all nl]
> Sent: Monday, April 29, 2013 3:50 PM
> To: Open Source Security
> Subject: Re: [oss-security] OS command injection vulnerability in Chicken
> Scheme
>
> On Mon, Apr 29, 2013 at 01:33:12PM -0600, Kurt Seifried wrote:
> > > The full announcement is here:
> > > http://lists.nongnu.org/archive/html/chicken-announce/2013-
> 04/msg00000.html
> > Please use CVE-2013-2024 for this issue.
>
> Thank you.
>
> > > By the way, I'm confused as to why the CVEs I've requested so far
> > > don't show up in NVD.  For example,
> > > http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6122 says
> > > the CVE does not exist, but Kurt assigned it in February:
> > > http://www.openwall.com/lists/oss-security/2013/02/08/2
> > >
> > > The other CVE numbers in that mail produce a "not found" page as
> > > well and an NVD database search for "chicken" turns up nothing
> > > related to Chicken Scheme.  The page says the database was last
> > > updated April 19th 2013, so that's not the cause either.
> >
> > Because Mitre has a large backlog of CVE's to research and write up.
> > Submitting researched/written entries to them will probably result in
> > your entries being posted faster. Try to remember that CVE pushed
> > thousands of these a year, the volume is considerable.
>
> What sort of information would they require, besides the advisory
> I posted in my mail?  If there's something I can do better to make
> their lives easier, I will certainly consider it!
>
> > Apologies for the late reply
>
> No problem!
>
> Cheers,
> Peter
> --
> http://www.more-magic.net