Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 23 Aug 2018 04:36:05 -0700
From: Qualys Security Advisory <>
Cc: Dariusz Tytko <>
Subject: Re: OpenSSH Username Enumeration

Hi all,

On Thu, Aug 23, 2018 at 09:50:08AM +0200, Dariusz Tytko wrote:
> We have published our writeup

Great job, and thank you very much for reporting this to the OpenSSH
team in the first place!

Here is our (rough) timeline:

- On July 31,
  is committed publicly, but does not explain the reasons for this
  change, and does not flag it as a security fix.

- We read this commit about two weeks later, and realize its security
  implications; we do not know whether have been
  contacted about this or not.

- We therefore send our findings to and, on August 15.

- About 20 minutes later (!), Solar Designer confirms that we should
  post this to right away (as per indeed,
  the issue is already public (if we spotted this commit, then others
  did, too).

- About one hour later, we post our findings to oss-security.

Again, we thank Dariusz Tytko for reporting this issue, for their quick response, and the OpenSSH team
for all their hard and inspiring work. With best regards,

the Qualys Security Advisory team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.