Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 17 Aug 2018 15:14:01 +0200
From: Dominique Martinet <>
Subject: Re: Rule for releasing fixes for embargoed bugs

Marcus Meissner wrote on Fri, Aug 17, 2018:
> There seems to be some miscommunation here, which should be directly
> clarified with the security team of the affected distribution(s).

You are correct, I will also send them an email.

> Rule of thumb is: when a vendor publishes updates for an issue, the issue
> is public and can be referenced publically. I do not understand why you
> would get push back unless there are communication problems.
> Also FWIW CVE-2018-3690 is an older reference to "Bounds Check Bypass Store",
> which is now tracked as CVE-2018-3693 and is public.

Thank you for the reference to the new CVE, I only had what was in the
package changelog to go with and none of the trackers I know about
reference CVE-2018-3690 as a duplicate/old name of CVE-2018-3693, so it
was confusing.
This is actually pretty reassuring that the rule is then appropriately

That being said, if CVE-2018-3693 is public there really is no reason to
say what they said in the discussions I have had with the RDMA folks, so
I will work to clear that up.

Dominique Martinet

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.