Re: Re: backdoor in upstream xz/liblzma leading to ssh server compromise

[Andres Freund <andres () anarazel de>]

Hi,

On 2024-03-29 21:54:11 -0000, Tavis Ormandy wrote:
> On 2024-03-29, Solar Designer wrote:
> > > I have a minor procedural question for Solar though, shouldn't this
> > > have been redirected to oss-security immediately from distros? What's
> > > the rationale for an embargo here?
> >
> > We don't have a clear policy for such case.  Some distros list members
> > have indeed suggested making this public ASAP.  We ended up delaying
> > publication by one day per my suggestion (as a compromise between ASAP
> > and having no specific CRD), and I think these are some reasons why:
>
> Thanks, a compromise is better than nothing :) I think I would have
> argued for immediately discussing this in the open.

FWIW, I don't know much of the tradeoffs in this space. With that caveat:

Personally I would have felt quite hesitant to post to distros@ if I knew that
distros wouldn't get a reasonable, small, amount of time to prepare, so they
have fixed packages available at the time of the public posting.


> > 2. We didn't know how the culprit (or group) would react when they
> > learned of the full extent of the community's awareness.
>
> This is true with any vulnerability, there is always the possibility an
> attacker is already aware of it. They could respond to a patch being
> released by trying to extract as much value from their exploit before
> it's worthless.
>
> I'm not convinced that's a good argument to delay making the patch
> available?

What patch? You mean going back to an older version?

Greetings,

Andres Freund