Re: 3 new CVE's in vim

[Alan Coopersmith <alan.coopersmith () oracle com>]

Those incentives for reporting bugs as security vulnerabilities
haven't changed.  But previously maintainers had more incentive
to push back on claiming a bug was a security vulnerability - its
often more work for them to put out an advisory/new release than
just checking in a non-security fix.  Certainly I know as one of
the X.Org security team we'd not list things as security bugs if
they didn't let an attacker do something outside the bounds of
expected operation - for example, the X11 protocol already lets
a client terminate the connection of another client, so a bug
letting you do that is just a bug, not a vulnerability.

        -alan-

On 10/4/2021 9:04 AM, Alex Gaynor wrote:
> It seems a bit like huntr.dev makes an incentive, that has always
> existed, explicit: There are rewards for getting CVEs issued. Folks
> put them on their resumes, include them in audit reports they do, etc.
> At least they're paying for fixes as well!
>
> Alex
>
> On Mon, Oct 4, 2021 at 11:50 AM Alan Coopersmith
> <alan.coopersmith () oracle com> wrote:
> > On 9/30/2021 7:39 PM, Alan Coopersmith wrote:
> > > I haven't seen these make it to the list yet, but three CVE's were
> > > recently assigned for bugs in vim.  [I personally don't see how
> > > there's a security boundary crossed in normal vim usage here, but
> > > could see issues if someone had configured vim to run with raised
> > > privileges for editing system/application configuration files or
> > > similar.]
> >
> > I do note all three of these were submitted via huntr.dev, which offers
> > bounties for both reporting & fixing security bugs.  As a maintainer of
> > an upstream open source project which is struggling with finding people
> > to fix reported security bugs [1], I do appreciate the additional
> > incentive to provide fixes here.  But as a maintainer of a distro, I see
> > a mismatch with the incentives here, as you get bounties for accepting
> > everything as a security bug and not pushing back, and flooding the
> > distros with CVE's - even if your distro policy isn't to handle every
> > CVE that applies, security auditors will often make your users query
> > about every CVE that they think applies, costing your time to respond.
> >
> > [1] https://indico.freedesktop.org/event/1/contributions/28/
> > https://www.youtube.com/watch?v=IU3NeVvDSp0
> >
> > --
> >         -Alan Coopersmith-               alan.coopersmith () oracle com
> >          Oracle Solaris Engineering - https://blogs.oracle.com/alanc