[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 22 Jul 2019 07:12:21 -0700
From: Ian Zimmerman <itz@...y.loosely.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead
On 2019-07-22 13:50, Solar Designer wrote:
> Exactly. It's just an unusual disclosure process that involves giving
> the users a heads-up a few days before public disclosure of the actual
> vulnerabilities and fixes. So far, this process is practiced by
> OpenSSL and Exim (any others?)
>
> Unfortunately, this keeps confusing people, which is why this time
> Heiko's message starts with "Note: EMBARGO is still in effect".
> Judging by Mikhail's reply, this wasn't good enough to avoid
> confusion, and I don't know what would be - maybe a paragraph of text
> acknowledging that the disclosure process is unusual? Somehow I
> didn't notice such confusion in response to OpenSSL's
> pre-announcements (not here, but on their own announce list), so maybe
> Exim should try to reuse OpenSSL's wording. Here's an example:
>
> https://mta.openssl.org/pipermail/openssl-announce/2019-February/000145.html
FWIW, I really appreciate this way (Exim's and OpenSSL's) and I wish it
was the norm, rather than the exception.
--
Please don't Cc: me privately on mailing lists and Usenet,
if you also post the followup to the list or newsgroup.
To reply privately _only_ on Usenet and on broken lists
which rewrite From, fetch the TXT record for no-use.mooo.com.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
