Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 24 Jul 2019 09:55:13 +1200
From: Douglas Bagnall <>
Subject: Security release pre-announcement messages

On 22/07/19 11:50 PM, Solar Designer wrote:
> Exactly.  It's just an unusual disclosure process that involves giving
> the users a heads-up a few days before public disclosure of the actual
> vulnerabilities and fixes.  So far, this process is practiced by OpenSSL
> and Exim (any others?)

On the Samba team we use wording like this:

Subject: Heads-up: Security Releases ahead!


This is a heads-up that there will be Samba security updates on
Wednesday, June 19 2019. Please make sure that your Samba
servers will be updated soon after the release!

Impacted components:
 - AD DC (CVSS 6.5, Medium)

We now do this systematically, after a haphazard start.

To help ourselves stay on track, we are trying to formalise our
process into something approaching a checklist:

and we are happy to hear suggestions for improvement.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.