Post #3276440
2026-04-29 16:18 UTC
@tragivictoria@mastodon.catgirl.cloud
It was literally reported through the distro security communication channels because the upstream was compromised and the "random person" relied on distro to handle it.
"Given the apparent upstream involvement I have not reported an upstream bug. As I initially thought it was a debian specific issue, I sent a more preliminary report to security@...ian.org. Subsequently I reported the issue to distros@. CISA was notified by a distribution."
https://www.openwall.com/lists/oss-security/2024/03/29/4
@vwbusguy@mastodon.online
Replies (1)
-
@tragivictoria@mastodon.catgirl.cloud 2026-04-29 16:24
@bookwar@floss.social @vwbusguy@mastodon.online You misunderstood me. Distros certainly acted, the point is they acted when some random person told them, without checking for themselves before packaging affected version. The job of package maintainer is to bump the version, sometimes with checking release notes and sometimes not even that. Anything more is extreme rarity. Army of package maintainers from multiple distros, and it wasn't even them who discovered it.