Security Policy Update on prenotifications

{
  "id": "8085c119f4088cf56a08604a2079a942a3bccc3f7c030f6e9ead6958646bcc27",
  "url": "https://openssl-library.org/post/2020-05-12-security-prenotifications/",
  "method": "llm",
  "payload": {
    "kind": "other",
    "title": "Security Policy Update on prenotifications",
    "summary": "OpenSSL updated its security policy to allow prenotification of Premium Support customers about future High and Critical security issues. The change does not alter existing notification practices or the policy of keeping embargoes as short as possible.",
    "evidence": "The OMC voted this week to update our security policy to include the option of us giving prenotification to companies with which we have a commercial relationship. (Edited to clarify: the vote was to allow notification to our Premium Support customers",
    "products": [
      {
        "name": {
          "value": "OpenSSL",
          "evidence": "Thankfully severe OpenSSL security issues are quite rare."
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2020-1967",
        "evidence": "Last month we dealt with a High severity security vulnerability which affected some versions of OpenSSL, CVE-2020-1967"
      },
      {
        "value": "CVE-2017-3733",
        "evidence": "The previous High severity vulnerability was over 3 years earlier in 2017 CVE-2017-3733"
      },
      {
        "value": "CVE-2016-6309",
        "evidence": "and the last Critical was in 2016 CVE-2016-6309"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-openssl-news",
  "document_id": 24234,
  "published_at": "2020-05-12T09:00:00+00:00"
}