# How are CVE's handle by the community and disseminated? **URL:** \ **Category:** Elasticsearch\ **Created:** [June 16, 2016, 1:03am UTC](https://discuss.elastic.co/t/how-are-cves-handle-by-the-community-and-disseminated/52932 "2016-06-16T01:03:43Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Peter\_Portante](https://avatars.discourse-cdn.com/v4/letter/p/f9ae1b/32.png) [@Peter\_Portante](https://discuss.elastic.co/u/Peter_Portante)\ **Post date:** [June 16, 2016, 1:03am UTC](https://discuss.elastic.co/t/how-are-cves-handle-by-the-community-and-disseminated/52932/1 "2016-06-16T01:03:43Z")
Hi Folks, I recently saw a post from Debian Security Announce [[1]](https://lists.debian.org/debian-security-announce/2015/msg00290.html) talking about "The project no longer releases information on fixed security issues which allow back-porting them to released versions of Debian and actively discourages from doing so." I am curious. Is this statement still true? If not, is there a place where I can read about the current procedures for how CVEs are disseminated to the community? If it is true, is there community documentation describing why this was decided? If there isn't any documentation, how are folks handling this? Thanks, -peter [1] [https://lists.debian.org/debian-security-announce/2015/msg00290.html](https://lists.debian.org/debian-security-announce/2015/msg00290.html) ---
**Author:** ![nik9000](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nik9000/32/44947_2.png) [@nik9000](https://discuss.elastic.co/u/nik9000)\ **Post date:** [June 16, 2016, 2:17am UTC](https://discuss.elastic.co/t/how-are-cves-handle-by-the-community-and-disseminated/52932/2 "2016-06-16T02:17:36Z")
> [@Peter\_Portante](#): > > Is this statement still true? Yes. The critical part is > [@Peter\_Portante](#): > > which allow back-porting them to released versions of Debian This is because Debian wanted to backport security fixes to a very very old version instead of picking up new versions with the fixes. Elasticsearch as a project cuts new deb and rpm files whenever it cuts a new release and recommends those instead of anything your distribution ships. > [@Peter\_Portante](#): > > If not, is there a place where I can read about the current procedures for how CVEs are disseminated to the community? [https://www.elastic.co/community/security](https://www.elastic.co/community/security) In general you'll have to stay more up to date than something like Debian is willing to do. A year old version of Elasticsearch is quite old, for example. For what it is worth 2.x is much, much more paranoid than 1.x was, using things like seccomp to drop exec privileges and java's security sandbox. That isn't to say it is perfect just that we take security very seriously. ---
**Author:** ![kseifriedredhat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kseifriedredhat/32/10347_2.png) [@kseifriedredhat](https://discuss.elastic.co/u/kseifriedredhat)\ **Post date:** [June 16, 2016, 2:45am UTC](https://discuss.elastic.co/t/how-are-cves-handle-by-the-community-and-disseminated/52932/3 "2016-06-16T02:45:14Z")
So one note on CVE, the [https://www.elastic.co/community/security](https://www.elastic.co/community/security) link claims they can't get CVE's due to MITRE policy changes which is absolutely not true, but I can see how they might misunderstand the Mitre Swimlanes document [https://cve.mitre.org/cve/data\_sources\_product\_coverage.html](https://cve.mitre.org/cve/data_sources_product_coverage.html) anyways I've reached out to [security@elastic.co](mailto:security@elastic.co) with information and an offer to help with respect to getting CVEs. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 5, 2017, 10:43pm UTC](https://discuss.elastic.co/t/how-are-cves-handle-by-the-community-and-disseminated/52932/4 "2017-07-05T22:43:30Z")