Given the feedback so far on the available options, in an effort to avoid surprising our community while it's in the midst of its busiest conference week of the season I'm inclined to send the pre-OSSA (impact description and patches) to the downstream stakeholders on our embargo notice list today indicating Tuesday November 14 as the planned public disclosure for this advisory. That's 10 business days instead of our usual 3-5, but if someone happens to leak it early this is at least a limited enough vulnerability that it won't be too terrible of an emergency.
Given the feedback so far on the available options, in an effort to avoid surprising our community while it's in the midst of its busiest conference week of the season I'm inclined to send the pre-OSSA (impact description and patches) to the downstream stakeholders on our embargo notice list today indicating Tuesday November 14 as the planned public disclosure for this advisory. That's 10 business days instead of our usual 3-5, but if someone happens to leak it early this is at least a limited enough vulnerability that it won't be too terrible of an emergency.