Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <534533F7.3050700@canonical.com>
Date: Wed, 09 Apr 2014 07:50:15 -0400
From: Marc Deslauriers <marc.deslauriers@...onical.com>
To: oss-security@...ts.openwall.com
Subject: Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure
 CVE-2014-0160

On 14-04-09 03:32 AM, Yves-Alexis Perez wrote:
> On Wed, Apr 09, 2014 at 12:02:09PM +0530, Huzaifa Sidhpurwala wrote:
>> On 04/09/2014 01:07 AM, Yves-Alexis Perez wrote:
>>
>>> Mon, 07 Apr 2014 06:10 : Huzaifa Sidhpurwala sends a mail to distros
>>>                          list with no details but an offer to request
>>>                          them privately
>>
>>
>> After i sent a mail to distros, i was contacted by security engineers
>> from most major distributions. I answered most of the them as soon as i
>> could with complete details including the upstream patch.
> 
> I'm not sure who are “most major distributions”. We failed to reply in a
> timely fashion to that mail (but that's on us), but apparently so did
> Ubuntu, Suse sent a mail but got apparently no reply.

For the record, we did see the mail around 11:30 UTC, asked for details, but did
not get a reply before the issue went public.

It's quite unfortunate distros weren't able to prepare packages before this went
public, but this is the way it is sometimes.

I'd like to thank Huzaifa and Red Hat for attempting to coordinate updates by
notifying other distros before the original CRD.

Marc.



-- 
Marc Deslauriers
Ubuntu Security Engineer     | http://www.ubuntu.com/
Canonical Ltd.               | http://www.canonical.com/

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.