On Thu, 9 Apr 2026 08:11:03 +0200 Salvatore Bonaccorso <[email protected]> wrote:
> Hi Aaron, > > On Tue, Apr 07, 2026 at 08:09:06PM -0400, Aaron Rainbolt wrote: > [...] > > I discovered this while doing work for the Kicksecure and Whonix > > projects. This bug was reported privately to upstream on December > > 23, 2025. As per Kicksecure's Vulnerability Disclosure Policy [1], > > we're disclosing it publicly on April 7, 2026, 90 days + a 14-day > > grace period later. An upstream bug report can be seen at [2]. > > JFYI, the reference to the issue: It currently say: "This issue has > been deleted.". Is the issue reference correct, was it really deleted > or is there a typo? The issue reference is correct. systemd upstream didn't agree with Kicksecure's vulnerability disclosure policy, and elected to delete the bug report for being "irresponsible". I disagree with them, but in any event, the email contains all of the useful info that was in the upstream bug report. -- Aaron
pgparaH4vqwG0.pgp
Description: OpenPGP digital signature
