Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <baedf150-30b4-9039-6488-f5c7b479bb50@thelounge.net>
Date: Sun, 16 Sep 2018 23:29:27 +0200
From: Reindl Harald <h.reindl@...lounge.net>
To: "Kevin A. McGrail" <kmcgrail@...che.org>
Cc: SA Mailing list <users@...massassin.apache.org>,
 Spamassassin Devel List <dev@...massassin.apache.org>,
 announce@...massassin.apache.org, announce@...che.org,
 security@...massassin.apache.org, oss-security@...ts.openwall.com
Subject: Re: [SECURITY] Apache SpamAssassin 3.4.2 resolves CVE-2017-15705,
 CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781



Am 16.09.18 um 23:11 schrieb Kevin A. McGrail:
> Per the asf security team, mitre considers the public rc1 from a few
> days ago as the start of the clock for the publishing so we were already
> way past the 24 hour windiw.

again: i doubt that distributions push updates *NOW* because most
maintainers are not ware of the release nor do the expecit it at all
given how long we hear about 3.4.2 with no other official bugfix
releases for years

bad guys typically watch better than anyone else

> Hopefully, the announcements and reports are obfuscated and bugzilla ia
> private so it'll be contained.
> 
> On Sun, Sep 16, 2018, 16:59 Reindl Harald <h.reindl@...lounge.net
> <mailto:h.reindl@...lounge.net>> wrote:
> 
>     i doubt that it is wiese to blwo out security notes *that short* after
>     release and *that long* after the last release

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.