Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 23 Jul 2019 01:09:40 +1200
From: Amos Jeffries <>
Subject: Re: CVE-2019-13917 OVE-20190718-0006: Exim: security
 release ahead

On 22/07/19 11:50 pm, Solar Designer wrote:
> On Mon, Jul 22, 2019 at 12:29:53PM +0100, Stuart Henderson wrote:
>> On 2019/07/22 11:21, Mikhail Klementev wrote:
>>> Kindly notice that this is a public mail list.
>> The sender is clearly aware of this, see the timeline.
> Exactly.  It's just an unusual disclosure process that involves giving
> the users a heads-up a few days before public disclosure of the actual
> vulnerabilities and fixes.  So far, this process is practiced by OpenSSL
> and Exim (any others?)
> Unfortunately, this keeps confusing people, which is why this time
> Heiko's message starts with "Note: EMBARGO is still in effect".  Judging
> by Mikhail's reply, this wasn't good enough to avoid confusion, and I
> don't know what would be 

IMHO the key difference between the two is the initial impression one
gets from the message layout.

This Exim message looks just like any other full-detail disclosure
report. It takes time to read the text and clicking through to the
repository links to realize that this is not actually leaking code
changes and detail about the issue.

The OpenSSL is just a warning that a new version X is about to land.

People who care are left to do their own research into where to get it.
The distro teams who need the warning already know that.


Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.