On 08/25/2012 11:35 PM, Jamie Duncan wrote:
> This is something I've always wondered, but never seen 
> a consistent attitude on
>
> When a RHEL-derived distribution find new vulnerabilities, what 
> process do they go to report and address them?
>
>   * Do they go directly upstream?
>   * Do they report them in RHEL's bugzilla?
>   * Do they patch internally?
>   * Other?
>
> Over the years I've seen conflicing information in various forums, and 
> I've always wondered if there was a consistent method that was addressed.
>
> Cheers,
> jduncan

For SL, we generally advise posting directly to upstream if it is an 
upstream problem.  SL issues happen, but generally, problems are best 
resolved there.  That way the whole community can benefit from the fix 
while remaining fully compatible with upstream.  One of the best ways we 
can give back to our upstream providers is fixes, or at least guide them 
towards problems.

-- 
Pat Riehecky
Scientific Linux Developer