[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <82FEB890-2BBE-4E1E-968B-3CC16744C784@isc.org>
Date: Fri, 19 Feb 2021 11:27:27 +0100
From: Ondřej Surý <ondrej@....org>
To: Hanno Böck <hanno@...eck.de>
Cc: ISC Security Officer <security-officer@....org>,
oss-security@...ts.openwall.com
Subject: Re: BIND Operational Notification: Enabling the new
BIND option "stale-answer-client-timeout" can result in unexpected server
termination
Hi Hanno,
by the time Michael was writing the message, we were still reviewing
the fix for the issue.
The fix has been made public now:
https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/4714
FTR we are not treating this as a security issue as this is a newly
introduced option and disabled by default. Same reason why not
make a new release in a haste. There’s a whole QA machinery
around the release which means that we would be able to speed
up the release only by a week or so, and that doesn’t make much
sense.
Cheers,
Ondrej
--
Ondřej Surý (He/Him)
ondrej@....org
> On 19. 2. 2021, at 9:17, Hanno Böck <hanno@...eck.de> wrote:
>
> On Thu, 18 Feb 2021 20:09:47 -0900
> ISC Security Officer <security-officer@....org> wrote:
>
>> 2) If you already have packages based on 9.16.12, we expect to have
>> a patch ready well before the next maintenance release. A candidate
>> patch is under review now and can be delivered after review and
>> quality assurance testing. If you wish to receive updates on the
>> progress of this patch, please e-mail your request to
>> security-officer@....org
>
> I am confused by your actions here.
>
> You warn people about a messed up release (can happen, no problem), you
> say you have a preliminary patch, but you make it extra complicated to
> get that patch? Why not just post the patch?
>
> Also I read into your words that you don't plan to publish a quick
> followup release, which would be the right thing to do ("we expect to
> have a patch ready well before the next maintenance release" - I read
> that as you don't plan to make a new maintenance release as soon as
> the patch is ready, which would be the right thing to do).
>
>
> --
> Hanno Böck
> https://hboeck.de/
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
