Re: Qemu CVEs in Xen
On Tue, Nov 29, 2016 at 10:18:51AM +0100, Hugo Lefeuvre wrote:
> Hi,
>
> So far, I have triaged ~120 CVEs. I have used all my assigned hours, so
> I won't be able to finish the work this month.
>
> I have marked Xen as affected by 45 'new' CVEs until now. Not all of
> them deserve a DLA.
That doesn't make sense. Only a very small subset of the qemu copy
is security-relavant in Xen and if that happens they've usually
published an XSA advisory for it.
We only track embedded code copies in the data/CVE/list file if
there's a specific vulnerabilites, so please revert all those
spurious "- xen 4.4.0-1" entries unless you can show an explicit
vulnerability in the qemu integration in Xen. Right now you're
cluttering the xen entries for the security tracker and that's
not helpful at all.
Cheers,
Moritz
Reply to: