Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 22 Jul 2019 07:12:21 -0700
From: Ian Zimmerman <>
Subject: Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead

On 2019-07-22 13:50, Solar Designer wrote:

> Exactly.  It's just an unusual disclosure process that involves giving
> the users a heads-up a few days before public disclosure of the actual
> vulnerabilities and fixes.  So far, this process is practiced by
> OpenSSL and Exim (any others?)
> Unfortunately, this keeps confusing people, which is why this time
> Heiko's message starts with "Note: EMBARGO is still in effect".
> Judging by Mikhail's reply, this wasn't good enough to avoid
> confusion, and I don't know what would be - maybe a paragraph of text
> acknowledging that the disclosure process is unusual?  Somehow I
> didn't notice such confusion in response to OpenSSL's
> pre-announcements (not here, but on their own announce list), so maybe
> Exim should try to reuse OpenSSL's wording.  Here's an example:

FWIW, I really appreciate this way (Exim's and OpenSSL's) and I wish it
was the norm, rather than the exception.

Please don't Cc: me privately on mailing lists and Usenet,
if you also post the followup to the list or newsgroup.
To reply privately _only_ on Usenet and on broken lists
which rewrite From, fetch the TXT record for

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.