Date: Sun, 16 Sep 2018 23:29:27 +0200 From: Reindl Harald <h.reindl@...lounge.net> To: "Kevin A. McGrail" <kmcgrail@...che.org> Cc: SA Mailing list <users@...massassin.apache.org>, Spamassassin Devel List <dev@...massassin.apache.org>, announce@...massassin.apache.org, announce@...che.org, security@...massassin.apache.org, oss-security@...ts.openwall.com Subject: Re: [SECURITY] Apache SpamAssassin 3.4.2 resolves CVE-2017-15705, CVE-2016-1238, CVE-2018-11780 & CVE-2018-11781 Am 16.09.18 um 23:11 schrieb Kevin A. McGrail: > Per the asf security team, mitre considers the public rc1 from a few > days ago as the start of the clock for the publishing so we were already > way past the 24 hour windiw. again: i doubt that distributions push updates *NOW* because most maintainers are not ware of the release nor do the expecit it at all given how long we hear about 3.4.2 with no other official bugfix releases for years bad guys typically watch better than anyone else > Hopefully, the announcements and reports are obfuscated and bugzilla ia > private so it'll be contained. > > On Sun, Sep 16, 2018, 16:59 Reindl Harald <h.reindl@...lounge.net > <mailto:h.reindl@...lounge.net>> wrote: > > i doubt that it is wiese to blwo out security notes *that short* after > release and *that long* after the last release
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.