Re: CVEs in OpenWrt 22.03

2022-10-26 Thread Hauke Mehrtens
On 10/25/22 17:21, Dave Taht wrote: On Tue, Oct 25, 2022 at 7:37 AM Peter Naulls wrote: On 10/24/22 18:21, Hauke Mehrtens wrote: Hauke, thanks for replying! As I said on a related thread - if an eu body can be found to care more deeply on these issues, I'm pretty sure 30-50k of funding is

Re: CVEs in OpenWrt 22.03

2022-10-26 Thread Hauke Mehrtens
On 10/25/22 16:29, Peter Naulls wrote: On 10/24/22 18:21, Hauke Mehrtens wrote: Hauke, thanks for replying! I also prefer if the CVE number is named in the patch. If this is missing somewhere you could send a patch or pull request to rename the patch. I'm afraid I don't have any explicit

Re: CVEs in OpenWrt 22.03

2022-10-25 Thread Dave Taht
On Tue, Oct 25, 2022 at 7:37 AM Peter Naulls wrote: > > On 10/24/22 18:21, Hauke Mehrtens wrote: > > Hauke, thanks for replying! As I said on a related thread - if an eu body can be found to care more deeply on these issues, I'm pretty sure 30-50k of funding is available via one or more of

Re: CVEs in OpenWrt 22.03

2022-10-25 Thread Peter Naulls
On 10/24/22 18:21, Hauke Mehrtens wrote: Hauke, thanks for replying! I also prefer if the CVE number is named in the patch. If this is missing somewhere you could send a patch or pull request to rename the patch. I'm afraid I don't have any explicit examples, but I'll let you know if find

Re: CVEs in OpenWrt 22.03

2022-10-24 Thread Hauke Mehrtens
On 10/20/22 22:26, Peter Naulls wrote: Apologies for the obtuseness of the previous email about the squashfs permissions - that's related to the following, but a different topic.  I can now say that we're undergoing a security review for our system which is very much based upon OpenWrt

Re: CVEs in OpenWrt 22.03

2022-10-20 Thread Dave Taht
I feel your pain, and with the dual provenance of the openwrt kernel (linux X.Y and usually a backport of mac80211) it gets harder. (But other world vendors have it much, much harder, with their frankenkernels) I don't know what guidelines are coming out of this effort (https://openssf.org/ ) is