[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 16 Sep 2018 23:29:27 +0200
From: Reindl Harald <h.reindl@...lounge.net>
To: "Kevin A. McGrail" <kmcgrail@...che.org>
Cc: SA Mailing list <users@...massassin.apache.org>,
Spamassassin Devel List <dev@...massassin.apache.org>,
announce@...massassin.apache.org, announce@...che.org,
security@...massassin.apache.org, oss-security@...ts.openwall.com
Subject: Re: [SECURITY] Apache SpamAssassin 3.4.2 resolves CVE-2017-15705,
CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781
Am 16.09.18 um 23:11 schrieb Kevin A. McGrail:
> Per the asf security team, mitre considers the public rc1 from a few
> days ago as the start of the clock for the publishing so we were already
> way past the 24 hour windiw.
again: i doubt that distributions push updates *NOW* because most
maintainers are not ware of the release nor do the expecit it at all
given how long we hear about 3.4.2 with no other official bugfix
releases for years
bad guys typically watch better than anyone else
> Hopefully, the announcements and reports are obfuscated and bugzilla ia
> private so it'll be contained.
>
> On Sun, Sep 16, 2018, 16:59 Reindl Harald <h.reindl@...lounge.net
> <mailto:h.reindl@...lounge.net>> wrote:
>
> i doubt that it is wiese to blwo out security notes *that short* after
> release and *that long* after the last release
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
