How do the Debian Security team currently follow the vulnerabilities posted
upstream? I guess that's easy when the upstream maintainer (or the one that found the
bug) tells Debian's team before posting. But what if somebody posts in bugtraq a
security issue around a software available at Debian.
I know that the security team keeps track of bugtraq, but is there any public
database (a 'security.debian.org' virtual package at bugs.debian.org?) where interested
people can ask. Hey, what about Bugtraq-ID (or CVE-ID) XXX. Has it been fixed in
Debian?
what packages does it affect? has there been a DS released?
I guess a public database could be useful both for
- the team to coordinate themselves
- interested people to follow the situation and maybe help if needed
It is really a pain extracting and correlating DSA's and public announcements
(Bugtraq's DB) BTW, but I'll comment on this later on (after I'm done doing some
statistics for today's conference)
Regards
Javi
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
