Re: what text is being sent to researchers re: OSS assignments?

[Kurt Seifried <kseifried@redhat.com>]

If I get an Apache request I would forward it to them, I have already done so with a pile of hackerone related requests. 

On Mon, Dec 19, 2016 at 7:13 AM, Landfield, Kent B <kent.b.landfield@intel.com> wrote:

Can we please post this to the appropriate place? If you have an issue with this decision that the Board actively discussed, please as the question there.  There is no reason to cross-post every message to both lists.  This was a swim lane issue discussed by the Board and also discussed at the face-to-face meeting we had in Rockville, MD in November.

---
Kent Landfield
+1.817.637.8026

On 12/18/16, 8:44 PM, "owner-cve-cna-list@lists.mitre.org on behalf of jericho" <owner-cve-cna-list@lists.mitre.org on behalf of jericho@attrition.org> wrote:

    Reference:

    https://www.stevencampbell.info/2016/12/my-first-cve-2016-1000329-in-blogphp/

        I submitted my CVE request through Mitre who notified me that open
        source software CVE requests are now processed via the Distributed
        Weakness Filing before being sent to Mitre for inclusion in their
        database.

    This creates an obvious disconnect and potentially duplicate assignments
    and confusion, if researchers are being told to go to DWF for *all* OSS
    assignments. For example, Apache is a CNA and has many OSS projects, but
    vulnerabilities in their software should go to them, not DWF. Could MITRE
    share the text that is being sent out currently?

    .b

--

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@redhat.com