tech-pkg archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: Trust in version range in CVE

Leonardo Taccari writes:
> Frederic Fauberteau writes:
>> Hi,
> Hello Frederic,

Hello Leonardo,

>> I was looking at and I noticed that range is ImageMagick 7.0.9-27 through 7.0.10-17. We are now at 7.0.10-32 but I did not see any reference to CVE-2020-13902 in ImageMagick's ChangeLog. Could we consider to update pkg-vulnerabilities to introduce this range? In other words, could we trust
> In general: no, I would always double-check version listed with references
> and possible further upstream information (if any).
> The CPE information (`Known Affected Software Configurations') on
> most of the times is outdated/incorrect in my experience
> (I would just ignore it completely).
> When there aren't any useful references often
><cve-id> (where <cve-id>
> is, e.g. CVE-2020-12345) is a possible good resource to look.
> Most of the times you find a "through version x.y.z" in the CVE
> description - like in that case - it's probably a wildcard entry i.e.
> `ImageMagick-[0-9]*' (as it is currently is).
> Most of the times you find a "before version x.y.z" in the CVE
> description, that's usually correct.
Thank you for this clear explanation. You confirm the doubts I had about what I considered as an upper bound but that was not referenced upstream. 

Home | Main Index | Thread Index | Old Index