News for hackers. Stuff that matters.

A comment on System Down: A systemd-journald exploit. Parent comment

Re:System Down: A systemd-journald exploit by acdha on Thursday January 10, 2019 @01:12PM (#18876321)
You can document this, right? The researcher who finds a problem should be able to request a CVE even if the upstream doesn't acknowledge it.
[ Parent | on HN ]
Re:System Down: A systemd-journald exploit by justinclift on Thursday January 10, 2019 @04:11PM (#18878211)
The theory is good. :)

Weirdly though, getting a CVE assigned can be a real PITA (and unsuccessful). The people who do the CVE assignment are generally overloaded, so lower impact/priority stuff often seems to get missed or not bothered with.

[ Parent | on HN ]
Re:System Down: A systemd-journald exploit by ungamedplayer on Friday January 11, 2019 @01:14AM (#18881394)
This hasn't been the case for a number of years, Mitre has seriously picked up their game, and you can talk to linux vendors such as Red Hat, Ubuntu and SuSE who also have blocks of CVE's assigned for things they shipped.

The alternative is DWF, which would be more popular if this was a more common problem.

[ Parent | on HN ]
Re:System Down: A systemd-journald exploit by justinclift on Friday January 11, 2019 @08:09AM (#18883277)
> This hasn't been the case for a number of years ...

Thanks, that's really good news.

[ Parent | on HN ]