Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 27 Feb 2013 19:08:58 +0400
From: Solar Designer <>
Subject: Re: CVE request - Linux kernel: VFAT slab-based buffer overflow

On Wed, Feb 27, 2013 at 06:48:34AM -0800, Greg KH wrote:
> On Wed, Feb 27, 2013 at 07:31:30AM +0100, Petr Matousek wrote:
> > For starters, submissions should be posted to
> > oss-security or any other security related public mailing list when the
> > patch is being committed.
> That's not going to happen, and you know that, to do so would be totally
> irresponsible of us and directly harm your users.

Huh?!  Maybe you misread what Petr wrote?  Note: "when the patch is
being committed".  At this point, the security issue is public, and it
just needs to be properly communicated to all those interested
(including distros, sysadmins, etc.), such as via oss-security.  Not
doing this favors those few who spend time to review commits on their
own; some of them do it for purposes other than informing the public.

We have a similar policy for the distros and linux-distros private
lists.  When an issue initially brought up there is finally made public,
it must be brought up on oss-security.  I must admit there were a few
cases where we failed to do that, but they were just that - failures.
I'd appreciate help of other distros/linux-distros list members to
ensure that each and every issue is brought to oss-security when it is
being made public (even if only via commits of the fixes).  Formally,
this is responsibility of the original reporter:

"When the security issue is finally to be made public, it is your (the
original reporter's) responsibility to post about it to oss-security
(indeed, you and others may also post to any other mailing lists, etc.)"

but in practice the original reporter sometimes fails to do that, in
which case the list members should remind the reporter and/or take care
of bringing the issue to oss-security themselves.

I think should adopt a similar policy, and someone
on that list should be enforcing it.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.