[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140409073235.GB26700@scapa.corsac.net>
Date: Wed, 9 Apr 2014 09:32:36 +0200
From: Yves-Alexis Perez <corsac@...ian.org>
To: oss-security@...ts.openwall.com
Subject: Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information
disclosure CVE-2014-0160
On Wed, Apr 09, 2014 at 12:02:09PM +0530, Huzaifa Sidhpurwala wrote:
> On 04/09/2014 01:07 AM, Yves-Alexis Perez wrote:
>
> > Mon, 07 Apr 2014 06:10 : Huzaifa Sidhpurwala sends a mail to distros
> > list with no details but an offer to request
> > them privately
>
>
> After i sent a mail to distros, i was contacted by security engineers
> from most major distributions. I answered most of the them as soon as i
> could with complete details including the upstream patch.
I'm not sure who are “most major distributions”. We failed to reply in a
timely fashion to that mail (but that's on us), but apparently so did
Ubuntu, Suse sent a mail but got apparently no reply.
In any case, two days notice is a bit out of our comfort zone for
preparing updates, but I think we would have managed to handle it
properly if the embargo didn't break.
So again thanks Red Hat for notification/coordination job, but I'm still
puzzled at what happened earlier, before Red Hat was informed.
Regards,
--
Yves-Alexis Perez
Download attachment "signature.asc" of type "application/pgp-signature" (491 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
