Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160

[Yves-Alexis Perez <corsac () debian org>]

On Mon, Apr 07, 2014 at 01:56:27PM -0700, Reed Loden wrote:
> I just asked around on IRC, and one of the Ubuntu guys said they didn't
> get any prior notification of this, so fixed packages won't be out
> until tomorrow at the earliest (for Ubuntu).

Nor Debian neither Suse were aware either.
> Was this not coordinated with the distros at all? If not, that seems
> like major fail on the reporters and NCSC-FI's part. :/

There was a mail from Red Hat on monday morning (CEST) with no detail
and a CRD to april 9th. It seems OpenSSL advisory came a bit
uncoordinated, actually, which (it seems) triggered the release of the
heartbeat and cloudfare posts, as well as the Red Hat one here.

Regards,
-- 
Yves-Alexis Perez

Attachment: signature.asc
Description: Digital signature