Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead

                							

                <!--X-Body-Begin-->
<!--X-User-Header-->

oss-sec
mailing list archives
<!--X-User-Header-End-->
<!--X-TopPNI-->

By Date

By Thread

</form>

<!--X-TopPNI-End-->
<!--X-MsgBody-->
<!--X-Subject-Header-Begin-->
Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead

<!--X-Subject-Header-End-->
<!--X-Head-of-Message-->

From: Ian Zimmerman &lt;itz () very loosely org&gt;

Date: Mon, 22 Jul 2019 07:12:21 -0700

<!--X-Head-of-Message-End-->
<!--X-Head-Body-Sep-Begin-->

<!--X-Head-Body-Sep-End-->
<!--X-Body-of-Message-->
On 2019-07-22 13:50, Solar Designer wrote:

Exactly.  It's just an unusual disclosure process that involves giving
the users a heads-up a few days before public disclosure of the actual
vulnerabilities and fixes.  So far, this process is practiced by
OpenSSL and Exim (any others?)

Unfortunately, this keeps confusing people, which is why this time
Heiko's message starts with "Note: EMBARGO is still in effect".
Judging by Mikhail's reply, this wasn't good enough to avoid
confusion, and I don't know what would be - maybe a paragraph of text
acknowledging that the disclosure process is unusual?  Somehow I
didn't notice such confusion in response to OpenSSL's
pre-announcements (not here, but on their own announce list), so maybe
Exim should try to reuse OpenSSL's wording.  Here's an example:

https://mta.openssl.org/pipermail/openssl-announce/2019-February/000145.html

FWIW, I really appreciate this way (Exim's and OpenSSL's) and I wish it
was the norm, rather than the exception.

-- 
Please don't Cc: me privately on mailing lists and Usenet,
if you also post the followup to the list or newsgroup.
To reply privately _only_ on Usenet and on broken lists
which rewrite From, fetch the TXT record for no-use.mooo.com.

<!--X-Body-of-Message-End-->
<!--X-MsgBody-End-->
<!--X-Follow-Ups-->

<!--X-Follow-Ups-End-->
<!--X-References-->
<!--X-References-End-->
<!--X-BotPNI-->

By Date

By Thread

Current thread:

CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead Heiko Schlittermann (Jul 22)

Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead Mikhail Klementev (Jul 22)

Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead Stuart Henderson (Jul 22)

Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead Mikhail Klementev (Jul 22)

Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead Solar Designer (Jul 22)
Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead Amos Jeffries (Jul 22)

Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead Ian Zimmerman (Jul 22)

Security release pre-announcement messages Douglas Bagnall (Jul 24)
Re: Security release pre-announcement messages Stiepan (Jul 26)
Re: Security release pre-announcement messages Greg KH (Jul 26)
Re: Security release pre-announcement messages Greg KH (Jul 26)
Re: Security release pre-announcement messages Stiepan (Jul 26)

Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead Heiko Schlittermann (Jul 22)

Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead Eric Blake (Jul 22)

Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead Heiko Schlittermann (Jul 22)

Re: CVE-2019-13917 OVE-20190718-0006: Exim: security release ahead Solar Designer (Jul 26)

<!--X-BotPNI-End-->
<!--X-User-Footer-->
<!--X-User-Footer-End-->