Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Sun, 19 May 2013 11:07:59 +0200
From: Gilles Chehade <>
To: Kurt Seifried <>
Cc:, "Jason A. Donenfeld" <>,
Subject: Re: Re: CVE Request: DoS in OpenSMTPD TLS Support

On Sat, May 18, 2013 at 11:03:45PM -0600, Kurt Seifried wrote:
> Hash: SHA1
> On 05/18/2013 09:00 PM, Jason A. Donenfeld wrote:
> > On Sat, May 18, 2013 at 6:16 PM, Gilles Chehade <>
> > wrote:
> >> Not too nice to send a CVE request without ANY coordination with
> >> us ...
> > 
> > Sorry about that. I was in the midst of bumping packages in gentoo
> > to the snapshot where you had fixed the issue, when I figured it
> > might be wise to also get the issue tracked with a CVE asap. Sorry
> > for jumping the gun.
> For future reference you can get CVEs privately, although if you're
> not the official upstream this means there is a greater chance of
> duplicates (and thus of me saying "no, make a public request). So if
> you want to do this a possible compromise is to email me and the
> upstream and if upstream replies that it's ok then I'd probably go ahead.

Yes, that would have been much nicer.

We discovered the CVE request at the same time as everyone, on two
public lists along with a script that allows any kiddie to trigger
it... sent by a package maintainer we had talked to minutes ago to
explain the issue and who knew the fix release was two days away.

Anyway, what's done is done, we released earlier, hopefully we get
a bit more coordination next time.

Hopefully, we don't need too many CVE request anyways ;-)

Gilles Chehade                                          @poolpOrg

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.