Shared publicly  - 
 
We've had more than a few press enquiries at OpenSSL about the timeline of the CVE-2014-0160 (heartbleed) issue.  Here's the OpenSSL view of the timeline:

April 01 - Google contact the Google OpenSSL team members with details of the issue and a patch.  This was forwarded to the OpenSSL core team members (1109 UTC).  Original plan was to push that week, but it was postponed until April 09  to give time for proper processes.    Google tell us they've notified some infrastructure providers under embargo, we don't have the names or dates for these.

(Due to my unfortunate-timed holiday this week I used my Security Response Team members at Red Hat to help co-ordinate this issue on behalf of OpenSSL, but see below for when Red Hat Engineering were formally notified and started working on the issue for Red Hat)

April 07 (0556 UTC) OpenSSL (via me) notify Red Hat.  Red Hat internal bug created.  This is the time Red Hat was officially notified under embargo, engineers and the Red Hat Security Response Team started working on the issue.

April 07 (0610 UTC) Red Hat contact the private distros list (http://oss-security.openwall.org/wiki/mailing-lists/distros ) and let them know an OpenSSL issue is due on Wednesday (no details of the issue are given: just affected versions. Vendors are told to contact Red Hat for the full advisory under embargo.

April 07 - OpenSSL (via Red Hat) give details of the issue, advisory, and patch to the OS vendors that replied -- under embargo, telling them the issue will be public on April 09.   This was SuSE (0815 UTC), Debian (0816 UTC), FreeBSD (0849 UTC), AltLinux (1000 UTC).   Some other OS vendors replied but we did not give details in time before the issue was public, these included Ubuntu (asked at 1130 UTC), Gentoo (1414 UTC), Chromium (1615 UTC).
 
April 07 (1519 UTC) - CERT-FI contact me and Ben Laurie by encrypted email with details of the same issue found by Codenomicon.  This was forwarded to the OpenSSL core team members (1611 UTC)

April 07 - The coincidence of the two finds of the same issue at the same time increases the risk while this issue remained unpatched.  OpenSSL therefore released updated packages that day.

April 07 (1725 UTC) OpenSSL updates, web pages including vulndb, and security advisory (1839 UTC) gets made public.

So to be clear, OpenSSL notified only the following organisations prior to the public release of the issue: Red Hat, SuSE, Debian, FreeBSD, AltLinux.
28
13
Lino Mastrodomenico's profile photoFrederic Jacobs's profile photoJan Michael Alonzo's profile photoprudhvi tripuraneni's profile photo
6 comments
 
Akamai note on their blog that they were given advance notice of this issue by the OpenSSL team. This is incorrect. They were probably notified directly by one of the vulnerability finders.
 
I've filled in some more blanks, made it clear who OpenSSL notified in advance.  There are still a few more times to put in here which I'll do this week.
 
I've added the times that Red Hat on behalf of OpenSSL notified various distro vendors
 
+Mani Gandham That was the patch given to OpenSSL by Google on April 01 which was given to Red Hat engineering and entered into bugzilla on April 07.
Add a comment...