Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 24 Sep 2017 19:35:35 -0700
From: Igor Seletskiy <>
Subject: Re: Why send bugs embargoed to distros?

This pre-disclosure was very useful to CloudLinux. Most of our
customers are shared hosting companies and are affected by this bug.
The early notification gave us time to thoroughly test the fix, and
analyze if it can potentially have any side effects.
It also let us deliver the fix to beta channel right after the
announcement, and to the main channel a day later.

Igor Seletskiy |  CEO
CloudLinux OS   |   KernelCare   |   Imunify360

Get 24/7 free, exceptionally good support at
Follow us on twitter for technical updates: @CloudLinuxOS

On Sat, Sep 23, 2017 at 4:44 AM, Hanno Böck <> wrote:
> Hi,
> A few days have passed since the optionsbleed disclosure. Some
> interesting things have surfaced, e.g. the fact that it was apparently
> discovered already in 2014, but nobody noticed it was a security bug.
> But I'd like to discuss something else:
> I had informed the distros mailing list one week earlier about the
> upcoming disclosure with a bug description and links to the already
> available patch.
> My understanding is that the purpose of the distros list is that
> updates can be prepared so after a disclosure the time between "vuln is
> known" and "patch is available" is short.
> However from all I can see this largely didn't happen.
> Debian+Ubuntu took more than a day after disclosure to fix. According
> to the Debian bug tracker the bug got only opened after the public
> disclosure[2]. I see no sign that any work on a fix began before the
> disclosure.
> If I can trust Red Hat's CVE tracker [3] there still are no fixed
> packages available. Also I haven't found any info about updated
> opensuse packages.
> The only distro I'm aware of that prepared packages and pushed them
> right after disclosure is Gentoo.
> All of this makes me wonder if the distros list serves its purpose.
> I'd be curious to hear:
> a) if any people felt that pre-disclosure of optionsbleed was helpful
> to them and in which way (after all - even if it only helps minor
> distros and major distros ignore it it may still be a good thing).
> b) if people think that they'd usually prepare a fixed package, however
> they didn't consider optionsbleed important enough. (Naturally I
> probably have a bias seeing my findings as more important as other
> people, but I could live with that.)
> c) other things?
> [1]
> [2]
> [3]
> --
> Hanno Böck
> mail/jabber:
> GPG: FE73757FA60E4E21B937579FA5880072BBB51E42

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.