[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170923192315.GA17252@suse.de>
Date: Sat, 23 Sep 2017 21:23:15 +0200
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: Why send bugs embargoed to distros?
On Sat, Sep 23, 2017 at 01:44:18PM +0200, Hanno Böck wrote:
> Hi,
>
> A few days have passed since the optionsbleed disclosure. Some
> interesting things have surfaced, e.g. the fact that it was apparently
> discovered already in 2014, but nobody noticed it was a security bug.
>
>
> But I'd like to discuss something else:
> I had informed the distros mailing list one week earlier about the
> upcoming disclosure with a bug description and links to the already
> available patch.
> My understanding is that the purpose of the distros list is that
> updates can be prepared so after a disclosure the time between "vuln is
> known" and "patch is available" is short.
> However from all I can see this largely didn't happen.
>
> Debian+Ubuntu took more than a day after disclosure to fix. According
> to the Debian bug tracker the bug got only opened after the public
> disclosure[2]. I see no sign that any work on a fix began before the
> disclosure.
>
> If I can trust Red Hat's CVE tracker [3] there still are no fixed
> packages available. Also I haven't found any info about updated
https://www.suse.com/security/cve/CVE-2017-9798/
We have released openSUSE Leap and SUSE Linux Enterprise 12 SP2/SP3 updates.
Where did you look and not find this?
SUSE has rated the issue as moderate severity (bordering on important),
as exploitability seems difficult and not targetable.
So we were not targeting a "same as CRD day release" as with other more
severe issues, but have now released updates in the next days after the CRD.
In general predisclosure is useful for us, same as for the others for
evaluation and preparation of critical security issues.
Ciao, Marcus
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
