[openssl-users] Vulnerability Disclosures

[Richard Moore]

On 12 July 2015 at 03:31, Salz, Rich <rsalz at akamai.com> wrote:

> I'd be concerned about doing that.  While this one seemed pretty rare --
> only folks running a release less than 30 days old in production -- as a
> general rule, it's impossible to tell.  For example, we THINK that PSK
> isn't used much, but we have no idea -- it's real popular in the Internet
> of Things, for example.  It seems safer to say nothing, then to say
> something misleading or wrong.
>
> We'd like to give as much information as possible, but not enough to
> expose the vulnerability exploit and not anything that could be
> misleading.  It's a very hard point to triangulate.
>

​I don't really see this being feasible. For example many of our clients
get confused when we report openssl vulnerabilities against some SSL
accelerator or proxy device simply because they're unaware that the code in
the device is based on openssl.

Cheers

Rich.
​
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mta.openssl.org/pipermail/openssl-users/attachments/20150712/0048f9f7/attachment.html>