[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20130519090759.GA5331@poolp.org>
Date: Sun, 19 May 2013 11:07:59 +0200
From: Gilles Chehade <gilles@...lp.org>
To: Kurt Seifried <kseifried@...hat.com>
Cc: oss-security@...ts.openwall.com, "Jason A. Donenfeld" <Jason@...c4.com>,
misc@...nsmtpd.org
Subject: Re: Re: CVE Request: DoS in OpenSMTPD TLS Support
On Sat, May 18, 2013 at 11:03:45PM -0600, Kurt Seifried wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 05/18/2013 09:00 PM, Jason A. Donenfeld wrote:
> > On Sat, May 18, 2013 at 6:16 PM, Gilles Chehade <gilles@...lp.org>
> > wrote:
> >> Not too nice to send a CVE request without ANY coordination with
> >> us ...
> >
> > Sorry about that. I was in the midst of bumping packages in gentoo
> > to the snapshot where you had fixed the issue, when I figured it
> > might be wise to also get the issue tracked with a CVE asap. Sorry
> > for jumping the gun.
>
> For future reference you can get CVEs privately, although if you're
> not the official upstream this means there is a greater chance of
> duplicates (and thus of me saying "no, make a public request). So if
> you want to do this a possible compromise is to email me and the
> upstream and if upstream replies that it's ok then I'd probably go ahead.
>
Yes, that would have been much nicer.
We discovered the CVE request at the same time as everyone, on two
public lists along with a script that allows any kiddie to trigger
it... sent by a package maintainer we had talked to minutes ago to
explain the issue and who knew the fix release was two days away.
Anyway, what's done is done, we released earlier, hopefully we get
a bit more coordination next time.
Hopefully, we don't need too many CVE request anyways ;-)
--
Gilles Chehade
https://www.poolp.org @poolpOrg
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
