Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 8 Feb 2018 22:23:10 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: SEC Consult Vulnerability Lab <research@...-consult.com>
Subject: Re: SEC Consult SA-20180207-0 :: Multiple buffer overflow vulnerabilities in InfoZip UnZip

On Thu, Feb 08, 2018 at 08:19:20AM +0100, SEC Consult Vulnerability Lab wrote:
> 2018-01-17: Informing distros@...openwall.org about the upcoming advisory.
> 2018-02-01: Received CVE numbers.
> 2018-02-07: Publication of the advisory

Thanks for including the timeline.

So this is a violation of the distros list policy on maximum embargo
time.  Per list policy the reporter must have made the issue public in
at most 14 days, and per the tasks the distros had volunteered for
Gentoo (primary) and Amazon (backup) should have been posting reminders
for this to happen.  Instead, other distros posted such reminders
(thanks!) when it was already too late.

As list admin, I apologize for allowing this delay.  Yet I am not going
to watch the watchers all the time, which would be quite pointless (if I
were to do that, I could as well be taking care of all the tasks myself,
without asking the distros to volunteer for any).

Gentoo have already acknowledged the omission, and are taking measures.
I haven't heard from Amazon on this yet.

Alexander

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ