Re: OpenSSL 1.0.1 TLS/DTLS hearbeat information disclosure CVE-2014-0160

[Huzaifa Sidhpurwala <huzaifas () redhat com>]

On 04/09/2014 01:02 PM, Yves-Alexis Perez wrote:
> On Wed, Apr 09, 2014 at 12:02:09PM +0530, Huzaifa Sidhpurwala wrote:
> > On 04/09/2014 01:07 AM, Yves-Alexis Perez wrote:
> >
> > > Mon, 07 Apr 2014 06:10 : Huzaifa Sidhpurwala sends a mail to distros
> > >                          list with no details but an offer to request
> > >                          them privately
> >
> >
> > After i sent a mail to distros, i was contacted by security engineers
> > from most major distributions. I answered most of the them as soon as i
> > could with complete details including the upstream patch.
>
> I'm not sure who are “most major distributions”. We failed to reply in a
> timely fashion to that mail (but that's on us), but apparently so did
> Ubuntu, Suse sent a mail but got apparently no reply.

I have a list of people who asked and whom i answered, but i want to
restraint going into it now.

Suse was replied to via security () suse de :)

-- 
Huzaifa Sidhpurwala / Red Hat Security Response Team