Voiding CVE-2020-16248

[Richard Hartmann]

Dear all,

the Prometheus project[1] has received a public "vulnerability"
report[2] against what the reporter called SSRF, but what is the core
functionality of blackbox_exporter[3]: The ability to trigger network
probes over the network to monitor a target's availability. The
reporter stated that CVE-2020-16248 has been assigned. From context,
it seems to be a paid assessment of our software for an unnamed client
which increases motivation to get "results", in particular CVEs for
"zero days" - which are then promptly reported publicly with an
embargoed CVE.

The reporter has not replied to our statement that this behaviour is
core functionality. I could not find out which organization has
reserved CVE-2020-16248 so I decided to send email to this list to
inform the organization, enabling them to update their records.

Sorry for using this list for that purpose, I could not find a less
wrong place to inform the (hopefully) interested parties.


Best,
Richard

[1] https://prometheus.io/
[2] https://github.com/prometheus/blackbox_exporter/issues/669
[3] https://github.com/prometheus/blackbox_exporter

[Bartłomiej Płotka]

Thanks for this work Richi, this is quite... interesting that someone might mark core functionality as CVE.

Kind Regards,

Bartek

--
You received this message because you are subscribed to the Google Groups "Prometheus Team" group.
To unsubscribe from this group and stop receiving emails from it, send an email to prometheus-te...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/prometheus-team/CAD77%2BgR7G5zBc4pwQ86H-UuMk6QOgPcuK8R-hmmHqv8%2B8_%2Bdbw%40mail.gmail.com.

[Julien Pivotto]

On 08 Aug 11:16, Bartłomiej Płotka wrote:
> Thanks for this work Richi, this is quite... interesting that someone might
> mark core functionality as CVE.

That is not that crazy. You could "ddos" someone and hide your own IP
address.

> To view this discussion on the web visit https://groups.google.com/d/msgid/prometheus-team/CAMssQwbxY-LY1FmuZUeLEp2etkj6poQc%2BMVzL-ah%3DXoF2vptSg%40mail.gmail.com.

--
Julien Pivotto
@roidelapluie

[Richard Hartmann]

Thanks, Sylvain & Florian.

I wasn't aware that MITRE offered this option. I didn't want to send
email to them as I could no be certain if they own the CVE and as
putting random support burden on a closed list is worse than putting
it onto an open list IMO.

Will do.

On Sat, Aug 8, 2020 at 12:41 PM Sylvain Beucler <be...@beuc.net> wrote:
>
> Hi,

>
> On 08/08/2020 10:49, Richard Hartmann wrote:
> > I could not find out which organization has
> > reserved CVE-2020-16248 so I decided to send email to this list to
> > inform the organization, enabling them to update their records.
>

> I would suggest reaching MITRE:
> https://cve.mitre.org/cve/update_cve_entries.html
> - "Request an update to an exiting CVE entry"
> - Type: "Rejection"
>
> They'll either do the update or point you to the assigning CNA.
>
> Most likely they'll mark the issue as "DISPUTED" within a few business days.
>
> Cheers!
> Sylvain



--
Richard