[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20180817131401.GA28952@nautica>
Date: Fri, 17 Aug 2018 15:14:01 +0200
From: Dominique Martinet <asmadeus@...ewreck.org>
To: oss-security@...ts.openwall.com
Subject: Re: Rule for releasing fixes for embargoed bugs
Marcus Meissner wrote on Fri, Aug 17, 2018:
> There seems to be some miscommunation here, which should be directly
> clarified with the security team of the affected distribution(s).
You are correct, I will also send them an email.
> Rule of thumb is: when a vendor publishes updates for an issue, the issue
> is public and can be referenced publically. I do not understand why you
> would get push back unless there are communication problems.
>
> Also FWIW CVE-2018-3690 is an older reference to "Bounds Check Bypass Store",
> which is now tracked as CVE-2018-3693 and is public.
Thank you for the reference to the new CVE, I only had what was in the
package changelog to go with and none of the trackers I know about
reference CVE-2018-3690 as a duplicate/old name of CVE-2018-3693, so it
was confusing.
This is actually pretty reassuring that the rule is then appropriately
respected.
That being said, if CVE-2018-3693 is public there really is no reason to
say what they said in the discussions I have had with the RDMA folks, so
I will work to clear that up.
Thanks,
--
Dominique Martinet
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
