Re: CAN to CVE: changing changelogs?
On Thu, 27 Oct 2005, Joey Hess wrote:
> Henrique de Moraes Holschuh wrote:
> > 3. The security team's work is helped by adding the CVE
> > information to the proper changelog entry, to the point that
> > they have requested everyone to do so. This requires editing
> > past changelog entries quite often.
>
> I don't think that the security team has ever requested retoractive
> changing of changelogs for CVE entries. I find it hard to envision a
THAT will give me a lot of work to track down. This was pre BTS-usertags,
and I am not sure if it was from the regular sec. team or the testing sec.
team, and it was a passing comment on a thread. The "requested everyone"
might be a bit strong, I suppose, since a post to d-d-a was not made.
Well, I will try to hunt it down but google ain't helping much.
> Although these days I think you'll more likely see the relevant bug in
> the BTS be usertagged with the CVE id before the package is even
> released. Once that tag is there, we're tracking the security issue and
> the changelog entry will only matter to users and other security
> researchers.
Good to know.
--
"One disk to rule them all, One disk to find them. One disk to bring
them all and in the darkness grind them. In the Land of Redmond
where the shadows lie." -- The Silicon Valley Tarot
Henrique Holschuh
Reply to: