[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ZvX6_CRRRbCHSkzZ@aeon>
Date: Thu, 26 Sep 2024 17:23:24 -0700
From: Mark Esler <mark.esler@...onical.com>
To: oss-security@...ts.openwall.com
Subject: Re: CUPS printing system vulnerabilities
On Fri, Sep 27, 2024 at 01:49:52AM +0200, Solar Designer wrote:
> Thanks Alan! On Twitter, Alan further clarified that "once it was clear
> the info was out there, the distro makers wanted to end the embargo so
> they could publish advisories telling users to disable cups-browsed
> instead of waiting for patches to be available - those with VINCE access
> had hours of prior notice, not just two."
I don't believe this is how distro security teams saw it. Once a
vulnerability is leaked embargo no longer exists. In this case, the
original disclosure report was fully leaked online. Since the embargo
was broken and PoCs were posted, certainly nobody would want the
originally agreed to coordinated release date (CRD) of October 6th to be
kept. The intention of holding to a same day CRD (20:00 UTC) was to
stage the available patches for release and limit impact.
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
