Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise

[Florian Weimer <fw () deneb enyo de>]

* Anthony Liguori:

> I think we should have a policy that if issues are suspected to be
> actively exploited, that the issue goes public immediately.  If even
> there is no patch or mitigation, there's not a lot of benefit to
> keeping it private.

I think we are heading in this direction anyway, given that more and
more people are under reporting obligations for active exploitation.
Untangling who has to be notified when isn't really a good use of our
time.  I expect we'll have to tell reporters that if they tell us that
a vulnerabilty is under active exploitation, we'll have to go public
more or less immediately.