VU#976534 - How to submit security bugs?

VU#976534 - How to submit security bugs?

[CERT(R) Coordination Center]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Greetings,
	My name is Adam Rauf and I work for the CERT Coordination Center.  We
have a report that may affect KVM/QEMU.  How can we securely send it over to
you?  Thanks so much!

Adam Rauf
Software Engineering Institute
CERT Vulnerability Analysis Team

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)

iQEVAwUBUe2DstXCAanP4MNyAQI8nwf/eTb1Qox5lmgMHifDKRjj69E37FW+o5Jp
KMIP6+IgKdWQizPctXk2Gae50a+ioaXgkCGZZ7SwNJ9iE/AX2I32QvX6pZrDCBGw
l5Ht6UiwOLUTP3sKWO9AIYcgTDABzyNE2+bCGvDz8aqwLB8NNVqQ50f46TrQNlmB
oiG+XzskRG0BAxKTwWc8f4v+1hdqMtp811I7XmxXkAdtlmTWPHZfPiFs0dS++Puh
T0uLuC4nDo83hP6Yv8seMZKZZApFGfR+q4qKx7f6riNsa5v1zGgW2if++u+zRKvg
DvjLxjtRfE9JGmCZMBcFmRJ5y4Wx/m/2wtj2+a7D/D2Hd9L5LRB0lA==
=npI1
-----END PGP SIGNATURE-----

Re: VU#976534 - How to submit security bugs?

[Stefan Hajnoczi]

On Mon, Jul 22, 2013 at 02:49:50PM -0400, CERT(R) Coordination Center wrote:
> 	My name is Adam Rauf and I work for the CERT Coordination Center.  We
> have a report that may affect KVM/QEMU.  How can we securely send it over to
> you?  Thanks so much!

Paolo, Gleb, Anthony: Is this already being discussed off-list?

Adam: Paolo Bonzini and Gleb Natapov are the KVM kernel maintainers and
Anthony Liguori is QEMU maintainer.  You can verify this by checking
linux.git ./MAINTAINERS and qemu.git ./MAINTAINERS.  I suggest getting
in touch with them.

Stefan

Re: VU#976534 - How to submit security bugs?

[Anthony Liguori]

"CERT(R) Coordination Center" <cert@cert.org> writes:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Greetings,
> 	My name is Adam Rauf and I work for the CERT Coordination Center.  We
> have a report that may affect KVM/QEMU.  How can we securely send it over to
> you?  Thanks so much!

For QEMU bugs, please file a bug in Launchpad and mark it as a security
bug.  That will appropriately limit visibility.

http://launchpad.net/qemu

If you want to contact me directly, my public key is:

http://www.codemonkey.ws/files/aliguori.pub

You can verify that this key is what is used to sign QEMU releases at:

http://wiki.qemu.org/Download

Regards,

Anthony Liguori

>
> Adam Rauf
> Software Engineering Institute
> CERT Vulnerability Analysis Team
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.5 (GNU/Linux)
>
> iQEVAwUBUe2DstXCAanP4MNyAQI8nwf/eTb1Qox5lmgMHifDKRjj69E37FW+o5Jp
> KMIP6+IgKdWQizPctXk2Gae50a+ioaXgkCGZZ7SwNJ9iE/AX2I32QvX6pZrDCBGw
> l5Ht6UiwOLUTP3sKWO9AIYcgTDABzyNE2+bCGvDz8aqwLB8NNVqQ50f46TrQNlmB
> oiG+XzskRG0BAxKTwWc8f4v+1hdqMtp811I7XmxXkAdtlmTWPHZfPiFs0dS++Puh
> T0uLuC4nDo83hP6Yv8seMZKZZApFGfR+q4qKx7f6riNsa5v1zGgW2if++u+zRKvg
> DvjLxjtRfE9JGmCZMBcFmRJ5y4Wx/m/2wtj2+a7D/D2Hd9L5LRB0lA==
> =npI1
> -----END PGP SIGNATURE-----
> --
> To unsubscribe from this list: send the line "unsubscribe kvm" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html