[arch-security] Division of Labor

[Allan McRae]

On 14/03/14 07:20, RbN wrote:
>> I also think we need a system to track which CVEs have been dealt with.
>>
>> How about a wiki page with a table (per month?) with the following columns:
>>
>> CVE Id
>> Package/version
>> Date public
>> Update/Bug  (upstream version with fix or bug report number with patch)
>> Fixed version
>> Time vulnerable (for interest!)
>>
>> Allan
> 
> 
> I just created a page to track CVE for 2014 (if it gets too long, we will 
> split it later) : https://wiki.archlinux.org/index.php/CVE-2014
> 
> 
> It's basically a table wth the following columns for each CVE :
> CVE-id
> Package/version
> Date public
> Update/Bug  (upstream version with fix or bug report number with patch)
> Fixed version
> Time vulnerable (for interest!)
> 
> As you might see, any wikitext ninja is welcome to improve the table ;)
> 
> I will add some links later :
> CVE -ids linked to Mitre
> Package name linked to the good page
> FS# linked to the bug report
> 
> I filled it with the content of the file I used on my laptop to keep track of 
> CVE to see how it looks like with real content.
> 
> There is CVE with the time vulnerable field filled with "??", it means that I 
> didn't take time to check it, it's easy work for anybody willing to gets his 
> hands dirty with CVE management.

Great! The time was more of interest to me so we could track how well we
were doing with this.

Allan