Alexander:
Comments below.
Bruce
-----
On 1/23/25 3:57 PM, Solar Designer wrote:
Bruce,
Thank you very much for your reply. My reading of it is that Oracle is
already doing a lot (publication in 3 formats) and isn't willing to do
more (also separately send info pertaining to Oracle's Open Source
projects to oss-security). Is that correct?
We will sent eMail notifications to anyone that requests them ,
including oss-security, when we release security advisories which
include both open source and closed source products. Oracle will not
specifically call out open-source projects such as Java and MySQL but
Oracle expects recipients to filter Oracle's advisories for their
specific areas of interest. Since Oracle provides our advisories in
the Oasis machine readable standard CSAF format, Oracle expects such
organization to be able to automate such filtering and we know that many
customer do filtering by processing CSAF machine readable documents.
If so, maybe someone external should start doing that... or someone from
Oracle on one's own time... or people with the individual projects
(e.g., someone involved in MySQL and someone involved in VirtualBox
development)?
I am unclear regarding what you are requesting. Can you provide some
examples. I would note that security vulnerabilities and associated
CVEs are only published in Critical Patch Update and Security Alert
advisories.
Related to the last point/idea, I notice that the individual projects do
not appear to include security/CVE info in their release announcements.
For example, here are the recent ones for MySQL and VirtualBox with no
mention of the security issues/fixes at all:
https://dev.mysql.com/doc/relnotes/mysql/9.2/en/news-9-2-0.html
https://dev.mysql.com/doc/refman/9.2/en/mysql-nutshell.html
https://urldefense.com/v3/__https://www.virtualbox.org/wiki/Changelog-7.1__;!!ACWV5N9M2RV99hQ!OoHnj0vkzfVsOz2w-yZyUPG_tE06u7mGHbIT6M3zp4jbsWBZ9jfxUG10LiMQUMRdy4vQckczaUtFCUc6rJp8$
https://urldefense.com/v3/__https://www.virtualbox.org/wiki/Changelog-7.0__;!!ACWV5N9M2RV99hQ!OoHnj0vkzfVsOz2w-yZyUPG_tE06u7mGHbIT6M3zp4jbsWBZ9jfxUG10LiMQUMRdy4vQckczaUtFCYMzrXOJ$
Security vulnerabilities are announced in quarterly Critical Patch
Update Advisories such as
* https://www.oracle.com/security-alerts/cpujan2025.html
These include CVE and CVSS information. Vulnerabilities are not
announced until
all supported product versions have patches available so that
vulnerability fix information in
one version is less likely to be used in successful attacks against
versions that do
not yet have patches. Also, we like to test dependent versions of
batched products to
reduce the chances that vulnerability fixes in one product will lead to
incompatibilities
in other dependent products.
Maybe that's because the embargo end is coordinated centrally for the
Critical Patch Update, and the projects end up never being given a green
light to release the info on their own as well? Or just do not go back
and add previously-suppressed change log entries? If so, could this be
corrected? Just guessing here, I could as well be wrong about it.
The embargo end is coordinated centrally, as you suspected.
I am not familiar with the details of patch delivery in MySQL vs Virtual
Box vs Java, etc. with
respect to identification of which CVEs are addressed in specific
fixes. However, in many
other products this mapping is evident so I expect the same is true
here, as well.
Bruce
-----
Thanks again,
Alexander
On Thu, Jan 23, 2025 at 06:47:29AM -0800, Bruce Lowenthal wrote:
Olle, Solar Designer, oss-security list:
I am responsible for the content and publication of Oracle Critical
Patch Updates. These are published quarterly in three formats: Tabular
format HTML "AKA risk matrix", English Language HTML format and Oasis
Standard CSAF format via references at Oracle's Critical Patch Updates,
Security Alerts and Bulletins home page at
* https://www.oracle.com/security-alerts/
This home page references individual quarterly reports and provides
other information regarding our security program. In addition, that
page provides instructions allowing anyone to sign up to receive eMail
announcing when Oracle Critical Patch Updates and other security
advisories are published. See:
* Instructions for subscribing to email notifications
<https://www.oracle.com/security-alerts/securityemail.html>of
Critical Patch Update Advisories and Security Alerts.
If you have any questions, feel free to contact me directly.
Bruce
-----
On 1/22/25 11:50 PM, Olle E. Johansson wrote:
Bruce,
For your information.
/O
Begin forwarded message:
*From: *Solar Designer <so...@openwall.com>
*Subject: **[oss-security] Oracle January 2025 Critical Patch Update*
*Date: *23 January 2025 at 03:42:22 CET
*To: *oss-security@lists.openwall.com
*Reply-To: *oss-security@lists.openwall.com
Hi,
Once in a while, Oracle publishes what they call Critical Patch Update
documents, which list many vulnerabilities addressed across many Oracle
products, some of them Open Source and some not. This is great, but it
would be even better if Oracle also communicated to oss-security about
those vulnerabilities in its Open Source products, perhaps one message
per product (e.g., MySQL separately from VirtualBox). I hope someone
>from Oracle reads this and will get the wheels moving. Anyone?
Meanwhile, the latest Critical Patch Update is:
https://blogs.oracle.com/security/post/january-2025-cpu-released
https://www.oracle.com/security-alerts/cpujan2025.html
For MySQL, it says:
https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL
"Oracle MySQL Risk Matrix
This Critical Patch Update contains 39 new security patches, plus
additional third party patches noted below, for Oracle MySQL. 4 of
these vulnerabilities may be remotely exploitable without
authentication, i.e., may be exploited over a network without requiring
user credentials. The English text form of this Risk Matrix can be
found here."
and links to:
https://www.oracle.com/security-alerts/cpujan2025verbose.html#MSQL
and lists additional information on some CVEs not included in the matrix
itself (duplicate or not vulnerable). With so many CVEs, all of this is
rather long, but I imagine someone from Oracle - or someone external -
could copy-paste the "English text form of this Risk Matrix" and the
extra notes on a few CVEs to a separate message focusing on MySQL.
Similarly, there's info on a couple of VirtualBox CVEs here, which would
ideally be a separate message with copy-pasted detail:
https://www.oracle.com/security-alerts/cpujan2025.html#AppendixOVIR
https://www.oracle.com/security-alerts/cpujan2025verbose.html#OVIR
Perhaps there's more Open Source software listed in there, which needs
similar treatment. Not only this time, but each time, please.
Alexander
