bug#29182: CVE-2017-1000383: umask and backup files

[Stefan Kangas]

Eli Zaretskii <eliz@gnu.org> writes:

>> From: Glenn Morris <rgm@gnu.org>
>> Date: Mon, 13 Nov 2017 17:04:55 -0500
>>
>> Rightly or wrong, distributions etc pay attention to CVEs, so I think
>> an official response from Emacs on this issue would be good.
>
> I'm not sure how should we provide an official response there.  The
> list there is mostly of issues with very old versions, and there's a
> reference to bug reports which were closed.  What else is needed?  And
> what's the procedure?

OK, so this is almost 2 years old now, but I've looked into it a bit.

This CVE has been rejected by at least Debian ("this CVE assignment is
nonsense"), Redhat (bug has status "CLOSED WONTFIX") and Gentoo (bug has
status "INVALID").

I think it's fair to say that we don't want to "fix" this, since it
should not really have been a CVE in the first place.

I suggest to do the following:

1. There is a CVE status called disputed.  We should try to acquire that
   status.  More information at:
   https://cve.mitre.org/about/faqs.html#disputed_signify_in_cve_entry

   It would be good if someone more senior than me tried to contact
   MITRE, who handles the CVE to see how that works.  AFAICT, the way to
   contact them is through this web form: https://cveform.mitre.org/

2. Tag this bug as wontfix.

If MITRE don't reply, or do nothing -- fine, we close the bug.  If they
do reply, or better yet add the status disputed -- good, it's there for
posterity.  We then close the bug.

Best regards,
Stefan Kangas

PS. This CVE has the tag "withdrawn" in a Github repository which seems
to be handled by the CVE team at MITRE.  Not sure what that means, if
anything, but it seemed interesting enough to mention.

https://github.com/CVEProject/cvelist/pull/19