[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <c856bf26-33e3-cc79-d597-e023c61fe210@isc.org>
Date: Thu, 18 Feb 2021 23:26:44 -0900
From: Michael McNally <mcnally@....org>
To: Hanno Böck <hanno@...eck.de>
Cc: oss-security@...ts.openwall.com
Subject: Re: BIND Operational Notification: Enabling the new
BIND option "stale-answer-client-timeout" can result in unexpected server
termination
On 2/18/21 11:17 PM, Hanno Böck wrote:
> On Thu, 18 Feb 2021 20:09:47 -0900
> ISC Security Officer <security-officer@....org> wrote:
>
>> 2) If you already have packages based on 9.16.12, we expect to have
>> a patch ready well before the next maintenance release. A candidate
>> patch is under review now and can be delivered after review and
>> quality assurance testing. If you wish to receive updates on the
>> progress of this patch, please e-mail your request to
>> security-officer@....org
>
> I am confused by your actions here.
>
> You warn people about a messed up release (can happen, no problem), you
> say you have a preliminary patch, but you make it extra complicated to
> get that patch? Why not just post the patch?
In brief:
- the flawed releases were issued yesterday
- this morning the first customer reported the crash to us
- we isolated the root cause of the reported crash a short time after that
- we have written a candidate patch, but it has not yet been reviewed
or put through our QA process.
I think people here will not fault us for being understandably gun-shy
about compounding our error further.
We certainly don't want to make it more complicated than necessary
to obtain a patch, once we have one we are satisfied will safely
correct the problem without introducing other issues, but we don't
have that at this moment in time.
However, we were concerned that packagers would very likely be
scrambling to issue updated patches which correct the CVE we also
disclosed yesterday, if they had not already prepared them in advance.
So we thought it was imperative to announce the issue ASAP, even
while we work on reviewing and testing the candidate patch.
All the same, we know that there will be interest in a patch, so we
encourage people to request it now and it will be delivered when we
are satisfied we have screened it properly.
I hope that explains our actions better. We've been scrambling to
deal with this and don't have everything perfectly lined up but we
wanted to be transparent and not compound the problem by sitting
on information until we had everything neatly tied up.
Michael McNally
(for ISC Security Officer)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
