Re: Re: CVE Request: DoS in OpenSMTPD TLS Support

[Gilles Chehade <gilles () poolp org>]

On Sat, May 18, 2013 at 11:03:45PM -0600, Kurt Seifried wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 05/18/2013 09:00 PM, Jason A. Donenfeld wrote:
> > On Sat, May 18, 2013 at 6:16 PM, Gilles Chehade <gilles () poolp org>
> > wrote:
> > > Not too nice to send a CVE request without ANY coordination with
> > > us ...
> >
> > Sorry about that. I was in the midst of bumping packages in gentoo
> > to the snapshot where you had fixed the issue, when I figured it
> > might be wise to also get the issue tracked with a CVE asap. Sorry
> > for jumping the gun.
>
> For future reference you can get CVEs privately, although if you're
> not the official upstream this means there is a greater chance of
> duplicates (and thus of me saying "no, make a public request). So if
> you want to do this a possible compromise is to email me and the
> upstream and if upstream replies that it's ok then I'd probably go ahead.

Yes, that would have been much nicer.

We discovered the CVE request at the same time as everyone, on two
public lists along with a script that allows any kiddie to trigger
it... sent by a package maintainer we had talked to minutes ago to
explain the issue and who knew the fix release was two days away.

Anyway, what's done is done, we released earlier, hopefully we get
a bit more coordination next time.

Hopefully, we don't need too many CVE request anyways ;-)

-- 
Gilles Chehade

https://www.poolp.org                                          @poolpOrg