[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20140409052840.GA6223@openwall.com>
Date: Wed, 9 Apr 2014 09:28:40 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: Jussi Eronen <juhani.eronen@...ora.fi>
Subject: Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160
On Tue, Apr 08, 2014 at 10:28:24PM +0200, Yves-Alexis Perez wrote:
> Well, as I put in my tentative timeline, and according to Jussi Eronen
> (from NCSC-FI, afaict) mail in that thread, NCSC-FI only reported to
> OpenSSL ???a couple of hours before the advisory???, so my understand is
> that NCSC-FI was not aware of the vulnerability last week. Maybe
> Codenomicon was, though. Jussi, could you confirm that?
Codenomicon definitely was:
Domain Name: HEARTBLEED.COM
Creation Date: 2014-04-05 15:13:33
Registrant Name: Marko Laakso
Registrant Organization: Codenomicon Oy
Jarkko Lamsa (@lampska), "Fuzzing and threat intel @codenomicon, martial
arts", made some comments on Twitter:
<@lampska> @cynicalsecurity It was independent co-discovery. Plan was for responsible disclosure but it leaked (dunno where) forcing openssl go public
<_snagg> Wait, CloudFare fixed the OpenSSL bug 1week ago?somebody is getting the hang of this 'responsible disclosure' thing http://blog.cloudflare.com/staying-ahead-of-openssl-vulnerabilities
<@lampska> @_snagg Independent co-discovery. Plan was a responsible disclosure, but it went public too soon http://www.heartbeat.com
<@ysaw> @lampska @_snagg why did some get notified last week, but other didn't get notified until it went public?
<@lampska> @ysaw @_snagg I do not have visibility to what happened there. I do know we had just started conversations with CERTs when this went public
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
