{"thread":{"id":"46927","subject":"[Question] Documenting platform implications on CVE to git","startedAt":"2017-10-06T13:28:51Z","lastAt":"2017-10-07T00:04:57Z","messageCount":5,"participants":["Randall S. Becker","Jonathan Nieder"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"329885","messageId":"000801d33ea7$04a7c240$0df746c0$@nexbridge.com","threadId":"46927","inReplyTo":null,"subject":"[Question] Documenting platform implications on CVE to git","fromName":"Randall S. Becker","fromEmail":"rsbecker@nexbridge.com","sentAt":"2017-10-06T13:28:32Z","receivedAt":"2017-10-06T13:28:51Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"Hi All,\n\nI wonder whether there is some mechanism for providing official responses\nfrom platform ports relating to security CVE reports, like CVE-2017-14867.\nFor example, the Perl implementation on HPE NonStop does not include the SCM\nmodule so commands relating cvsserver may not be available - one thing to be\nverified so is a question #1. But the real question (#2) is: where would one\nmost appropriately document issues like this to be consistent with other\nplatform responses relating to git?\n\nThanks,\nRandall\n\n-- Brief whoami: NonStop&UNIX developer since approximately\nUNIX(421664400)/NonStop(211288444200000000) \n-- In my real life, I talk too much.\n\n\n\n"},{"id":"329948","messageId":"20171006225049.GA19555@aiede.mtv.corp.google.com","threadId":"46927","inReplyTo":"000801d33ea7$04a7c240$0df746c0$@nexbridge.com","subject":"Re: [Question] Documenting platform implications on CVE to git","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2017-10-06T22:50:49Z","receivedAt":"2017-10-06T22:50:57Z","isPatch":false,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"Hi Randall,\n\nRandall S. Becker wrote:\n\n> I wonder whether there is some mechanism for providing official responses\n> from platform ports relating to security CVE reports, like CVE-2017-14867.\n\nThis question is too abstract for me.  Can you say more concretely\nwhat you are trying to do?\n\nE.g. are you asking how you would communicate to users of your port\nthat CVE-2017-14867 does not apply to them?  Or are you asking where\nto start a conversation about who a bug applies to?  Or something\nelse?\n\nThanks,\nJonathan\n\n> For example, the Perl implementation on HPE NonStop does not include the SCM\n> module so commands relating cvsserver may not be available - one thing to be\n> verified so is a question #1. But the real question (#2) is: where would one\n> most appropriately document issues like this to be consistent with other\n> platform responses relating to git?\n>\n> Thanks,\n> Randall\n>\n> -- Brief whoami: NonStop&UNIX developer since approximately\n> UNIX(421664400)/NonStop(211288444200000000)\n> -- In my real life, I talk too much.\n"},{"id":"329950","messageId":"005b01d33efb$a5668870$f0339950$@nexbridge.com","threadId":"46927","inReplyTo":"20171006225049.GA19555@aiede.mtv.corp.google.com","subject":"RE: [Question] Documenting platform implications on CVE to git","fromName":"Randall S. Becker","fromEmail":"rsbecker@nexbridge.com","sentAt":"2017-10-06T23:34:19Z","receivedAt":"2017-10-06T23:34:38Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"-----Original Message-----\nOn October 6, 2017 6:51 PM, Jonathan Nieder wrote\n>Randall S. Becker wrote:\n>> I wonder whether there is some mechanism for providing official \n>> responses from platform ports relating to security CVE reports, like\nCVE-2017-14867.\n\n>This question is too abstract for me.  Can you say more concretely what you\nare trying to do?\n>E.g. are you asking how you would communicate to users of your port that\nCVE-2017-14867\n?does not apply to them?  Or are you asking where to start a conversation\nabout\n>who a bug applies to?  Or something else?\n\nThe first one, mostly. When looking at CVE-2017-14867, there are places like\nhttps://nvd.nist.gov/vuln/detail/CVE-2017-14867 where the issue is\ndiscussed. It provides hyperlinks to various platform discussions.\nUnfortunately for me, I am not an HPE employee - and even if I was, there is\nno specific site where I can publicly discuss the vulnerability. I'm looking\nto the group here for advice on how to get the word out that it does not\nappear to apply to the HPE NonStop Git port. The question of where to best\ndo that for any CVE pertaining to git as applicable to the NonStop Port is\nquestion #1.\n\nQuestion #2 - probably more relevant to the specific issue and this group -\nis whether the vulnerability is contained to Git's use of Perl SCM and since\nNonStop's Perl does not support SCM, the vulnerability may not be relevant,\nbut I'm not really enough of a Perl guru to make that determination.\n\nCheers,\nRandall\n\n-- Brief whoami: NonStop&UNIX developer since approximately\nUNIX(421664400)/NonStop(211288444200000000) \n-- In my real life, I talk too much.\n\n\n\n"},{"id":"329951","messageId":"20171006234442.GB19555@aiede.mtv.corp.google.com","threadId":"46927","inReplyTo":"005b01d33efb$a5668870$f0339950$@nexbridge.com","subject":"Re: [Question] Documenting platform implications on CVE to git","fromName":"Jonathan Nieder","fromEmail":"jrnieder@gmail.com","sentAt":"2017-10-06T23:44:42Z","receivedAt":"2017-10-06T23:44:50Z","isPatch":false,"sender":{"key":"jrnieder@gmail.com","avatar":"https://avatars.githubusercontent.com/u/281595?v=4"},"body":"Hi,\n\nRandall S. Becker wrote:\n\n> The first one, mostly. When looking at CVE-2017-14867, there are places like\n> https://nvd.nist.gov/vuln/detail/CVE-2017-14867 where the issue is\n> discussed. It provides hyperlinks to various platform discussions.\n> Unfortunately for me, I am not an HPE employee - and even if I was, there is\n> no specific site where I can publicly discuss the vulnerability. I'm looking\n> to the group here for advice on how to get the word out that it does not\n> appear to apply to the HPE NonStop Git port. The question of where to best\n> do that for any CVE pertaining to git as applicable to the NonStop Port is\n> question #1.\n\nHow do people find out about the HPE NonStop Git port?  Where is it\ndistributed?  Does that distribution point allow you to publish\nrelease notes or other documentation?\n\nDo you have a web page?  That's another place you can publish\ninformation.  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14867\nlinks to lots of resources that are not from the Git project.\n\nThe oss-security list <http://www.openwall.com/lists/oss-security/>\nallows anyone to participate.  It is a place that people often\ncollaborate to figure out the impact of a published vulnerability, how\nto mitigate it, etc.  There are other similar mailing lists elsewhere,\ntoo.\n\n> Question #2 - probably more relevant to the specific issue and this group -\n> is whether the vulnerability is contained to Git's use of Perl SCM and since\n> NonStop's Perl does not support SCM, the vulnerability may not be relevant,\n> but I'm not really enough of a Perl guru to make that determination.\n\nWhat is Perl SCM?  I don't know what you're talking about.\n\nThanks,\nJonathan\n"},{"id":"329952","messageId":"006601d33eff$d8d8b620$8a8a2260$@nexbridge.com","threadId":"46927","inReplyTo":"20171006234442.GB19555@aiede.mtv.corp.google.com","subject":"RE: [Question] Documenting platform implications on CVE to git","fromName":"Randall S. Becker","fromEmail":"rsbecker@nexbridge.com","sentAt":"2017-10-07T00:04:24Z","receivedAt":"2017-10-07T00:04:57Z","isPatch":false,"sender":{"key":"randall.becker@nexbridge.ca","avatar":"https://avatars.githubusercontent.com/u/28956764?v=4"},"body":"-----Original Message-----\nOn October 6, 2017 7:45 PM  Jonathan Nieder wrote: Cc: git@vger.kernel.org\n>Randall S. Becker wrote:\n>> The first one, mostly. When looking at CVE-2017-14867, there are \n>> places like\n>> https://nvd.nist.gov/vuln/detail/CVE-2017-14867 where the issue is \n>> discussed. It provides hyperlinks to various platform discussions.\n>> Unfortunately for me, I am not an HPE employee - and even if I was, \n>> there is no specific site where I can publicly discuss the \n>> vulnerability. I'm looking to the group here for advice on how to get \n>> the word out that it does not appear to apply to the HPE NonStop Git \n>> port. The question of where to best do that for any CVE pertaining to \n>> git as applicable to the NonStop Port is question #1.\n\n>How do people find out about the HPE NonStop Git port?  Where is it distributed? \n\nIt is available at http://ituglib.connect-community.org/apps/Ituglib/SrchOpenSrcLib.jsf but we have limited abilities to modify anything but that page. There is a brief release note but nothing sufficient to have a discussion. \n\n>Does that distribution point allow you to publish release notes or other documentation?\n\nNot enough for what I think are our needs.\n \n> Do you have a web page?  That's another place you can publish information. \n> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-14867\n> links to lots of resources that are not from the Git project.\n> The oss-security list <http://www.openwall.com/lists/oss-security/>\n> allows anyone to participate.  It is a place that people often collaborate to figure out the impact of a published\n> vulnerability, how to mitigate it, etc.  There are other similar mailing lists elsewhere, too.\n\nThanks, I'll take these to the team.\n\n>> Question #2 - probably more relevant to the specific issue and this \n>> group - is whether the vulnerability is contained to Git's use of Perl \n>> SCM and since NonStop's Perl does not support SCM, the vulnerability \n>> may not be relevant, but I'm not really enough of a Perl guru to make that determination.\n\n>What is Perl SCM?  I don't know what you're talking about.\n\nBase Perl does not have a lot of capability beyond a simple interpreter. The CPAN project,  https://www.cpan.org/, provides implementations of useful modules, including Source Code Management (SCM) modules that enable things like cvsserver AFAIK, and Mercurial to run. Without it (being the ability to arbitrarily add CPAN modules, which is an issue on NonStop), Perl tends to be a bit handcuffed and blindfolded. 😉\n\nThanks for the suggestions,\nRandall\n\n"}]}