oss-sec mailing list archives
Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160
From: Marc Deslauriers <marc.deslauriers () canonical com>
Date: Wed, 09 Apr 2014 07:50:15 -0400
On 14-04-09 03:32 AM, Yves-Alexis Perez wrote:
On Wed, Apr 09, 2014 at 12:02:09PM +0530, Huzaifa Sidhpurwala wrote:On 04/09/2014 01:07 AM, Yves-Alexis Perez wrote:Mon, 07 Apr 2014 06:10 : Huzaifa Sidhpurwala sends a mail to distros list with no details but an offer to request them privatelyAfter i sent a mail to distros, i was contacted by security engineers from most major distributions. I answered most of the them as soon as i could with complete details including the upstream patch.I'm not sure who are “most major distributions”. We failed to reply in a timely fashion to that mail (but that's on us), but apparently so did Ubuntu, Suse sent a mail but got apparently no reply.
For the record, we did see the mail around 11:30 UTC, asked for details, but did not get a reply before the issue went public. It's quite unfortunate distros weren't able to prepare packages before this went public, but this is the way it is sometimes. I'd like to thank Huzaifa and Red Hat for attempting to coordinate updates by notifying other distros before the original CRD. Marc. -- Marc Deslauriers Ubuntu Security Engineer | http://www.ubuntu.com/ Canonical Ltd. | http://www.canonical.com/
Current thread:
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160, (continued)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Solar Designer (Apr 08)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Michal Zalewski (Apr 09)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Jussi Eronen (Apr 25)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Donald Stufft (Apr 08)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Vincent Danen (Apr 08)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Florian Weimer (Apr 08)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Huzaifa Sidhpurwala (Apr 08)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Yves-Alexis Perez (Apr 09)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Huzaifa Sidhpurwala (Apr 09)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Marcus Meissner (Apr 09)
- Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160 Marc Deslauriers (Apr 09)