How does a possible bug & solution get bumped to be GLSA?

bokkepoot

Case in point:

https://bugs.gentoo.org/show_bug.cgi?id=212147 , about a CVE-2008-1066

On 2008-03-15 21:06:50, the remark was made: "glsa request filed."

Can I see what the state of that request is somewhere?
Do all the dependent blocked bugs have to get GLSA's first and if so, why is it that the system GLSA isn't issued first, and the packages that bundle stuff sol?

Am I missing something obvious?

bokkepoot · Posted: Fri Apr 18, 2008 7:15 pm Post subject:

and to answer my own question:

the way it works is http://www.gentoo.org/security/en/vulnerability-policy.xml