Date: Thu, 18 Feb 2021 23:26:44 -0900 From: Michael McNally <mcnally@....org> To: Hanno Böck <hanno@...eck.de> Cc: oss-security@...ts.openwall.com Subject: Re: BIND Operational Notification: Enabling the new BIND option "stale-answer-client-timeout" can result in unexpected server termination On 2/18/21 11:17 PM, Hanno Böck wrote: > On Thu, 18 Feb 2021 20:09:47 -0900 > ISC Security Officer <security-officer@....org> wrote: > >> 2) If you already have packages based on 9.16.12, we expect to have >> a patch ready well before the next maintenance release. A candidate >> patch is under review now and can be delivered after review and >> quality assurance testing. If you wish to receive updates on the >> progress of this patch, please e-mail your request to >> security-officer@....org > > I am confused by your actions here. > > You warn people about a messed up release (can happen, no problem), you > say you have a preliminary patch, but you make it extra complicated to > get that patch? Why not just post the patch? In brief: - the flawed releases were issued yesterday - this morning the first customer reported the crash to us - we isolated the root cause of the reported crash a short time after that - we have written a candidate patch, but it has not yet been reviewed or put through our QA process. I think people here will not fault us for being understandably gun-shy about compounding our error further. We certainly don't want to make it more complicated than necessary to obtain a patch, once we have one we are satisfied will safely correct the problem without introducing other issues, but we don't have that at this moment in time. However, we were concerned that packagers would very likely be scrambling to issue updated patches which correct the CVE we also disclosed yesterday, if they had not already prepared them in advance. So we thought it was imperative to announce the issue ASAP, even while we work on reviewing and testing the candidate patch. All the same, we know that there will be interest in a patch, so we encourage people to request it now and it will be delivered when we are satisfied we have screened it properly. I hope that explains our actions better. We've been scrambling to deal with this and don't have everything perfectly lined up but we wanted to be transparent and not compound the problem by sitting on information until we had everything neatly tied up. Michael McNally (for ISC Security Officer)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.