Delivery-date: Wed, 10 Jul 2024 01:09:08 -0700
Received-SPF: pass (google.com: domain of darosior@protonmail.com designates 185.70.43.25 as permitted sender) client-ip=185.70.43.25;
Date: Wed, 10 Jul 2024 07:40:46 +0000
To: Antoine Riard <antoine.riard@gmail.com>
From: "'Antoine Poinsot' via Bitcoin Development Mailing List" <bitcoindev@googlegroups.com>
Cc: Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Subject: Re: [bitcoindev] Re: Public disclosure of 10 vulnerabilities
 affecting Bitcoin Core < 0.21.0
Message-ID: <kIhV8zCjV9UxkbWZQRWCiQPj9viUYzO4xAeWBiRCio4w0BeIqAi1weUgs7E7Ftv7w94igEJZtXEmnKMpfHM4VtmPnLrJa8Im26P0QRsWLjI=@protonmail.com>
In-Reply-To: <a3a30a30-a28b-4348-a0bd-5a70714997e7n@googlegroups.com>
References: <xsylfaVvODFtrvkaPyXh0mIc64DWMCchxiVdTApFqJ_0Q5v0bOoDpS_36HwDKmzdDO9U2RKMzESEiVaq47FTamegi2kCNtVZeDAjSR4G7Ic=@protonmail.com> <a3a30a30-a28b-4348-a0bd-5a70714997e7n@googlegroups.com>
Feedback-ID: 7060259:user:proton
MIME-Version: 1.0
Content-Type: multipart/alternative;
 boundary="b1_qnGJhEl9ygMNc8NaoJI6fTfyDXNHEQDDw2hcnxRaa8U"
Reply-To: Antoine Poinsot <darosior@protonmail.com>
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com

This is a multi-part message in MIME format.

--b1_qnGJhEl9ygMNc8NaoJI6fTfyDXNHEQDDw2hcnxRaa8U
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hey Antoine,

> I think one thing that could be a benefit could be to assign a unique num=
eric identifier to each sec advisory.

Those are underway. We retro-actively requested CVE numbers for historical =
issues from Mitre.

Best,
Antoine (the other other one).
On Tuesday, July 9th, 2024 at 3:16 AM, Antoine Riard <antoine.riard@gmail.c=
om> wrote:

> Hello Antoine,
>
> Nothing really new in those 10 security advisories, I think one thing tha=
t could be a benefit could be to assign a unique numeric identifier to each=
 sec advisory.
>
> As openssh showed this week this could be good to minimize risks of regre=
ssions by favoring methodic screen of old vulnerabilities at review of new =
changes.
>
> On the security researcher / handler-side, having unique numeric identifi=
ers make it also easier to coordinate mitigation patches development and de=
ployment.
>
> Best,
> Antoine (the other one).
> Le mercredi 3 juillet 2024 =C3=A0 17:36:02 UTC+1, Antoine Poinsot a =C3=
=A9crit :
>
>> Hi everyone,
>>
>> Today we are releasing 10 security advisories for the Bitcoin Core proje=
ct. Those bugs affect versions of Bitcoin Core before (and not including) 0=
.21.0.
>>
>> This is part of the gradual adoption by the project of a new vulnerabili=
ty disclosure policy.
>>
>> The policy and the 10 security advisories can be found on the project's =
website at https://bitcoincore.org/en/security-advisories .
>>
>> We will follow up later in july to publicly disclose vulnerabilities fix=
ed in version 22.0. And then in august to disclose those fixed in version 2=
3.0, and so on until we run out of old unmaintained versions to disclose vu=
lnerabilities for. The announced policy will then start to be observed for =
new versions.
>>
>> Antoine Poinsot
>
> --
> You received this message because you are subscribed to the Google Groups=
 "Bitcoin Development Mailing List" group.
> To unsubscribe from this group and stop receiving emails from it, send an=
 email to bitcoindev+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgi=
d/bitcoindev/a3a30a30-a28b-4348-a0bd-5a70714997e7n%40googlegroups.com.

--=20
You received this message because you are subscribed to the Google Groups "=
Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/=
bitcoindev/kIhV8zCjV9UxkbWZQRWCiQPj9viUYzO4xAeWBiRCio4w0BeIqAi1weUgs7E7Ftv7=
w94igEJZtXEmnKMpfHM4VtmPnLrJa8Im26P0QRsWLjI%3D%40protonmail.com.

--b1_qnGJhEl9ygMNc8NaoJI6fTfyDXNHEQDDw2hcnxRaa8U
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div style=3D"font-family: Arial, sans-serif; font-size: 14px; color: rgb(0=
, 0, 0); background-color: rgb(255, 255, 255);">Hey Antoine,</div><div styl=
e=3D"font-family: Arial, sans-serif; font-size: 14px; color: rgb(0, 0, 0); =
background-color: rgb(255, 255, 255);"><br></div><blockquote style=3D"borde=
r-color: rgb(200, 200, 200); border-left: 3px solid rgb(200, 200, 200); pad=
ding-left: 10px; color: rgb(102, 102, 102);"><div style=3D"font-family: Ari=
al, sans-serif; font-size: 14px; color: rgb(0, 0, 0); background-color: rgb=
(255, 255, 255);"><span>I think one thing that could be a benefit could be =
to assign a unique numeric identifier to each sec advisory.</span></div></b=
lockquote><div style=3D""><br></div><div style=3D""><span style=3D"font-fam=
ily: Arial, sans-serif; font-size: 14px; font-weight: 400; color: rgb(0, 0,=
 0); background-color: rgb(255, 255, 255);">Those are underway. We retro-ac=
tively requested CVE numbers for historical issues </span>from Mitre.</div>=
<div style=3D""><br></div><div style=3D"">Best,</div><div style=3D"">Antoin=
e (the other other one).<br></div><div class=3D"protonmail_quote">
        On Tuesday, July 9th, 2024 at 3:16 AM, Antoine Riard &lt;antoine.ri=
ard@gmail.com&gt; wrote:<br>
        <blockquote class=3D"protonmail_quote" type=3D"cite">
            Hello Antoine,<div><br></div><div>Nothing really new in those 1=
0 security advisories, I think one thing that could be a benefit could be t=
o assign a unique numeric identifier to each sec advisory.</div><div><br></=
div><div>As openssh showed this week this could be good to minimize risks o=
f regressions by favoring methodic screen of old vulnerabilities at review =
of new changes.</div><div><br></div><div>On the security researcher / handl=
er-side, having unique numeric identifiers make it also easier to coordinat=
e mitigation patches development and deployment.</div><div><br></div><div>B=
est,</div><div>Antoine (the other one).<br><br></div><div class=3D"gmail_qu=
ote"><div class=3D"gmail_attr" dir=3D"auto">Le mercredi 3 juillet 2024 =C3=
=A0 17:36:02 UTC+1, Antoine Poinsot a =C3=A9crit :<br></div><blockquote sty=
le=3D"margin: 0 0 0 0.8ex; border-left: 1px solid rgb(204, 204, 204); paddi=
ng-left: 1ex;" class=3D"gmail_quote">Hi everyone,
<br>
<br>Today we are releasing 10 security advisories for the Bitcoin Core proj=
ect. Those bugs affect versions of Bitcoin Core before (and not including) =
0.21.0.
<br>
<br>This is part of the gradual adoption by the project of a new vulnerabil=
ity disclosure policy.
<br>
<br>The policy and the 10 security advisories can be found on the project's=
 website at <a data-saferedirecturl=3D"https://www.google.com/url?hl=3Dfr&a=
mp;q=3Dhttps://bitcoincore.org/en/security-advisories&amp;source=3Dgmail&am=
p;ust=3D1720112766726000&amp;usg=3DAOvVaw0ZIGVGNIhgpYTc1sZGwO_d" rel=3D"nor=
eferrer nofollow noopener" target=3D"_blank" href=3D"https://bitcoincore.or=
g/en/security-advisories">https://bitcoincore.org/en/security-advisories</a=
> .
<br>
<br>We will follow up later in july to publicly disclose vulnerabilities fi=
xed in version 22.0. And then in august to disclose those fixed in version =
23.0, and so on until we run out of old unmaintained versions to disclose v=
ulnerabilities for. The announced policy will then start to be observed for=
 new versions.
<br>
<br>Antoine Poinsot
<br></blockquote></div>

<p></p>

-- <br>
You received this message because you are subscribed to the Google Groups "=
Bitcoin Development Mailing List" group.<br>
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com" rel=3D"n=
oreferrer nofollow noopener" target=3D"_blank">bitcoindev+unsubscribe@googl=
egroups.com</a>.<br>
To view this discussion on the web visit <a href=3D"https://groups.google.c=
om/d/msgid/bitcoindev/a3a30a30-a28b-4348-a0bd-5a70714997e7n%40googlegroups.=
com" rel=3D"noreferrer nofollow noopener" target=3D"_blank">https://groups.=
google.com/d/msgid/bitcoindev/a3a30a30-a28b-4348-a0bd-5a70714997e7n%40googl=
egroups.com</a>.<br>

        </blockquote><br>
    </div>

<p></p>

-- <br />
You received this message because you are subscribed to the Google Groups &=
quot;Bitcoin Development Mailing List&quot; group.<br />
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to <a href=3D"mailto:bitcoindev+unsubscribe@googlegroups.com">bitcoind=
ev+unsubscribe@googlegroups.com</a>.<br />
To view this discussion on the web visit <a href=3D"https://groups.google.c=
om/d/msgid/bitcoindev/kIhV8zCjV9UxkbWZQRWCiQPj9viUYzO4xAeWBiRCio4w0BeIqAi1w=
eUgs7E7Ftv7w94igEJZtXEmnKMpfHM4VtmPnLrJa8Im26P0QRsWLjI%3D%40protonmail.com?=
utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/d/msgid/b=
itcoindev/kIhV8zCjV9UxkbWZQRWCiQPj9viUYzO4xAeWBiRCio4w0BeIqAi1weUgs7E7Ftv7w=
94igEJZtXEmnKMpfHM4VtmPnLrJa8Im26P0QRsWLjI%3D%40protonmail.com</a>.<br />

--b1_qnGJhEl9ygMNc8NaoJI6fTfyDXNHEQDDw2hcnxRaa8U--