> > I wanted to suggest that when notifying of new vulnerabilities, in addition
> to the severity level, information is also provided about how widespread the
> issue is expected to be.
I'd be concerned about doing that. While this one seemed pretty rare -- only
folks running a release less than 30 days old in production -- as a general
rule, it's impossible to tell. For example, we THINK that PSK isn't used much,
but we have no idea -- it's real popular in the Internet of Things, for
example. It seems safer to say nothing, then to say something misleading or
wrong.
We'd like to give as much information as possible, but not enough to expose the
vulnerability exploit and not anything that could be misleading. It's a very
hard point to triangulate.
/r$
_______________________________________________
openssl-users mailing list
To unsubscribe: https://mta.openssl.org/mailman/listinfo/openssl-users
