Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160

[Marcus Meissner <meissner () suse de>]

On Tue, Apr 08, 2014 at 12:05:25AM +0200, Yves-Alexis Perez wrote:
> On Mon, Apr 07, 2014 at 01:56:27PM -0700, Reed Loden wrote:
> > I just asked around on IRC, and one of the Ubuntu guys said they didn't
> > get any prior notification of this, so fixed packages won't be out
> > until tomorrow at the earliest (for Ubuntu).
>
> Nor Debian neither Suse were aware either.

Just for correctness, SUSE (and the other distros members) received
Redhats heads up yesterday morning.

> > Was this not coordinated with the distros at all? If not, that seems
> > like major fail on the reporters and NCSC-FI's part. :/
>
> There was a mail from Red Hat on monday morning (CEST) with no detail
> and a CRD to april 9th. It seems OpenSSL advisory came a bit
> uncoordinated, actually, which (it seems) triggered the release of the
> heartbeat and cloudfare posts, as well as the Red Hat one here.

Giving the impact an immediate release on any indications that this was
public is better.

Ciao, Marcus