Date: Thu, 23 Aug 2018 04:36:05 -0700 From: Qualys Security Advisory <qsa@...lys.com> To: oss-security@...ts.openwall.com Cc: Dariusz Tytko <dariusz.tytko@...uritum.pl> Subject: Re: OpenSSH Username Enumeration Hi all, On Thu, Aug 23, 2018 at 09:50:08AM +0200, Dariusz Tytko wrote: > We have published our writeup > https://sekurak.pl/openssh-users-enumeration-cve-2018-15473/ Great job, and thank you very much for reporting this to the OpenSSH team in the first place! Here is our (rough) timeline: - On July 31, https://github.com/openbsd/src/commit/779974d35b4859c07bc3cb8a12c74b43b0a7d1e0 is committed publicly, but does not explain the reasons for this change, and does not flag it as a security fix. - We read this commit about two weeks later, and realize its security implications; we do not know whether distros@...openwall.org have been contacted about this or not. - We therefore send our findings to openssh@...nssh.com and distros@...openwall.org, on August 15. - About 20 minutes later (!), Solar Designer confirms that we should post this to oss-security@...ts.openwall.com right away (as per https://oss-security.openwall.org/wiki/mailing-lists/distros): indeed, the issue is already public (if we spotted this commit, then others did, too). - About one hour later, we post our findings to oss-security. Again, we thank Dariusz Tytko for reporting this issue, distros@...openwall.org for their quick response, and the OpenSSH team for all their hard and inspiring work. With best regards, -- the Qualys Security Advisory team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.