Bug#508031: Tracking vulnerabilities that have already been patched in other distributions
* Michael Gilbert:
>>>> Since we don't just blindly apply fixes from other
>>>> distributions and there still needs to be someone who can
>>>> check this additional information I fail to see that this
>>>> is needed for us.
>>>
>>> There is no harm in getting an overview of what other
>>> distributions do, though.
>>
>> The cost of maintaining that information separately has to be
>> considered, too. A lot of this information is available through NVD,
>> albeit with some delay.
>
> As long as someone is willing to do the work, I don't see it as too
> burdensome. It's simply a matter of watching the other distribution's
> security announcements (usually 0-10 per day) and updating the tracker
> with that information. I would be willing to do it all myself.
Again, this information is already available from NVD. Here's an
example:
<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-1447>
> I think debian should do all that it can to avoid lag in security
> updates, and that means getting the word out about the problem as soon
> as possible (not addressed here) as well as getting word out when a
> solution has been found asap (this suggestion addresses this problem).
It would help if we were able automatically extract diffs from the
source RPMs published by other distributions. This is something that
should be scriptable, but it's not really trivial, either.
Reply to: