oss-sec mailing list archives
Re: CVE for program distributing vulnerable components ?
From: Simon McVittie <smcv () debian org>
Date: Fri, 14 Feb 2020 09:54:55 +0000
On Fri, 14 Feb 2020 at 00:11:00 +0100, security minded wrote:
I've identified a program whose installer contains components with known CVEs. Should one or several CVE be asked for the installer itself ?
The CVE IDs for the individual vulnerable components are enough to describe the vulnerability. You don't need new CVE IDs to describe the fact that the installer installs vulnerable components. Linux distribution packages are like installers, if you think about it - and when a security vulnerability like CVE-2018-16428 is reported in an upstream project like GLib, the same CVE ID is used to represent the vulnerability in unfixed versions of the upstream project, unfixed Debian packages, unfixed Fedora packages and so on. We say something like "Debian 9's glib2.0 package is vulnerable to CVE-2018-16428". Otherwise we'd need many more CVE IDs than we do now. smcv
Current thread:
- CVE for program distributing vulnerable components ? security minded (Feb 14)
- Re: CVE for program distributing vulnerable components ? Simon McVittie (Feb 14)
- Re: CVE for program distributing vulnerable components ? Francis Perron (Feb 14)
- Re: CVE for program distributing vulnerable components ? Simon McVittie (Feb 14)