[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20180208212310.GA12669@openwall.com>
Date: Thu, 8 Feb 2018 22:23:10 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: SEC Consult Vulnerability Lab <research@...-consult.com>
Subject: Re: SEC Consult SA-20180207-0 :: Multiple buffer overflow vulnerabilities in InfoZip UnZip
On Thu, Feb 08, 2018 at 08:19:20AM +0100, SEC Consult Vulnerability Lab wrote:
> 2018-01-17: Informing distros@...openwall.org about the upcoming advisory.
> 2018-02-01: Received CVE numbers.
> 2018-02-07: Publication of the advisory
Thanks for including the timeline.
So this is a violation of the distros list policy on maximum embargo
time. Per list policy the reporter must have made the issue public in
at most 14 days, and per the tasks the distros had volunteered for
Gentoo (primary) and Amazon (backup) should have been posting reminders
for this to happen. Instead, other distros posted such reminders
(thanks!) when it was already too late.
As list admin, I apologize for allowing this delay. Yet I am not going
to watch the watchers all the time, which would be quite pointless (if I
were to do that, I could as well be taking care of all the tasks myself,
without asking the distros to volunteer for any).
Gentoo have already acknowledged the omission, and are taking measures.
I haven't heard from Amazon on this yet.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
