Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 14 Sep 2017 15:04:43 +0200
From: Solar Designer <>
Cc: Denis Ovsienko <>
Subject: Re: tcpdump 4.9.2 is fully available

On Wed, Sep 13, 2017 at 09:59:13PM +0100, Denis Ovsienko wrote:
> As per Alexander's advice, let me comment for the avoidance of doubt that all deliverables for the tcpdump 4.9.2 release are public since today as advised last week. This includes individual commits in the public git repository with reference to particular CVE IDs and credits to the original reporter(s) and the author of each bugfix.

Thank you, Denis.  I was hoping you'd post more like a full advisory,
and include the credits and maybe the disclosure timeline.  I should
have been more specific.

Here's my reconstruction of the timeline:

Unknown date(s) - issues found

Unknown date(s) - issues reported to upstream

September 3 - tcpdump 4.9.2 release prepared, but not supposed to be
made public yet

Unknown date(s) - private disclosure (by upstream?) to some distros (not
via the distros list) with CRD set to September 25 (since a 3 week
embargo was mentioned elsewhere, this could have been on September 4)

September 4 - "The tar.gz turned up in the public release directory on 4
September by an accident"

September 5 - "and was deleted on 5 September"

September 5 - at least Mageia and Fedora update their tcpdump packages,
apparently due to these projects' automated monitoring for new upstream
releases (IIRC, as confirmed by links to automatically-created bug
tracking entries and such)

September 6 - upstream sends private message to some distros about the
leak, moving the CRD to September 13

September 6 - first notification to the distros list by NixOS, who are
not on the list and who thought the information was already known to
list members, saying in part "We don't think that the embargo can be
sustained under these conditions, even for another week."

September 6-8 - several people and distros try and fail to convince
upstream to go public with the full detail ASAP, but nevertheless
receive explicit permission to go ahead with releasing updated packages

September 7 - an Arch Linux developer (who is not on (linux-)distros and
apparently was not aware of the distros list discussion) brings the
issue to oss-security (it's unclear to me how that person knew of the
September 25 initial CRD); I approve that message right away

September 8 - upstream posts a clarification to oss-security, confirming
that distros are right to proceed with releasing updates; the tarball is
placed on the website

September 13 - full detail is made public (I think this means individual
commits rather than only the tree as a whole)


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.