[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAKghNw2tx1MqnRF-osqZQ4x5PWak8jTT1nvjrcZrJtrFOQdZdQ@mail.gmail.com>
Date: Sat, 27 Mar 2021 15:28:52 -0700
From: Gordon Tetlow <gordon@...lows.org>
To: oss-security@...ts.openwall.com
Subject: Re: OpenSSL 1.1.1 CVE-2021-3450 CA certificate check
bypass with X509_V_FLAG_X509_STRICT, CVE-2021-3449 NULL pointer deref in
signature_algorithms processing
On Sat, Mar 27, 2021 at 11:05 AM Solar Designer <solar@...nwall.com> wrote:
>
> One other detail I feel I have to bring up in here, and expect a
> response to, is Wind River's apparent leak of the vulnerability detail
> two days prior to scheduled public disclosure. This was brought up on
> the distros list back then, and I was also asked about it on Twitter
> when the vulnerabilities were finally made public appropriately on the
> scheduled date.
>
> Since the vulnerability detail wasn't on the distros list, it's not
> exactly a case of a list member leaking from there, but it's closely
> related. And regardless of where this happened, it's a concern, which
> we probably should discuss on oss-security.
>
> So I'd appreciate an explanation/statement from Wind River on what
> happened and what measures, if any, are being taken to prevent this from
> happening again. I'd also appreciate a comment from OpenSSL.
>
> The leak was on a web page archived here:
>
> https://web.archive.org/web/20210324105700/https://support2.windriver.com/index.php?page=security-notices&on=view&id=7055
While I am neither Wind River nor OpenSSL, I did notice on the linked
page that the upper right hand corner says:
Released: Apr 22, 2020 Updated: Mar 22, 2021
Without knowing much else, it feels like someone accidentally put a
"released" date as last year and the content management system went
ahead and made the article public. Hard to say without confirmation,
but I could definitely see that being the chain of events.
Gordon
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
