Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 23 Aug 2018 04:36:05 -0700
From: Qualys Security Advisory <qsa@...lys.com>
To: oss-security@...ts.openwall.com
Cc: Dariusz Tytko <dariusz.tytko@...uritum.pl>
Subject: Re: OpenSSH Username Enumeration

Hi all,

On Thu, Aug 23, 2018 at 09:50:08AM +0200, Dariusz Tytko wrote:
> We have published our writeup
> https://sekurak.pl/openssh-users-enumeration-cve-2018-15473/

Great job, and thank you very much for reporting this to the OpenSSH
team in the first place!

Here is our (rough) timeline:

- On July 31,
  https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0
  is committed publicly, but does not explain the reasons for this
  change, and does not flag it as a security fix.

- We read this commit about two weeks later, and realize its security
  implications; we do not know whether distros@...openwall.org have been
  contacted about this or not.

- We therefore send our findings to openssh@...nssh.com and
  distros@...openwall.org, on August 15.

- About 20 minutes later (!), Solar Designer confirms that we should
  post this to oss-security@...ts.openwall.com right away (as per
  https://oss-security.openwall.org/wiki/mailing-lists/distros): indeed,
  the issue is already public (if we spotted this commit, then others
  did, too).

- About one hour later, we post our findings to oss-security.

Again, we thank Dariusz Tytko for reporting this issue,
distros@...openwall.org for their quick response, and the OpenSSH team
for all their hard and inspiring work. With best regards,

-- 
the Qualys Security Advisory team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.