Date: Thu, 8 Feb 2018 22:23:10 +0100 From: Solar Designer <solar@...nwall.com> To: oss-security@...ts.openwall.com Cc: SEC Consult Vulnerability Lab <research@...-consult.com> Subject: Re: SEC Consult SA-20180207-0 :: Multiple buffer overflow vulnerabilities in InfoZip UnZip On Thu, Feb 08, 2018 at 08:19:20AM +0100, SEC Consult Vulnerability Lab wrote: > 2018-01-17: Informing distros@...openwall.org about the upcoming advisory. > 2018-02-01: Received CVE numbers. > 2018-02-07: Publication of the advisory Thanks for including the timeline. So this is a violation of the distros list policy on maximum embargo time. Per list policy the reporter must have made the issue public in at most 14 days, and per the tasks the distros had volunteered for Gentoo (primary) and Amazon (backup) should have been posting reminders for this to happen. Instead, other distros posted such reminders (thanks!) when it was already too late. As list admin, I apologize for allowing this delay. Yet I am not going to watch the watchers all the time, which would be quite pointless (if I were to do that, I could as well be taking care of all the tasks myself, without asking the distros to volunteer for any). Gentoo have already acknowledged the omission, and are taking measures. I haven't heard from Amazon on this yet. Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ