02/25/2020 - Disclosed to vendor. 90-day date is May 25, 2020.
02/25/2020 - Druva confirms receipt of the report.
03/19/2020 - Tenable asks for an update.
03/20/2020 - Druva acknowledges. They will discuss internally and get back to us on a fix timeline.
03/20/2020 - Tenable thanks Druva.
04/13/2020 - Tenable asks for an update.
04/14/2020 - Druva says they are working on an exact fix. Will update us by the end of this week.
04/14/2020 - Tenable thanks Druva.
04/27/2020 - Tenable asks for an update.
04/27/2020 - Druva is targeting a May 1st release of an intermediate build.
04/28/2020 - Tenable acknowledges. Reiterates our policy and willingness to test the build.
05/05/2020 - Matteo Malvica informs us that he submitted this same bug to Druva. Druva told him that Tenable found it first, and it is a duplicate.
05/06/2020 - M. Malvica asks to be mentioned in our public disclosure.
05/06/2020 - Tenable contacts Druva to verify if M. Malvica has, indeed, submitted a duplicate finding.
05/06/2020 - Druva confirms this was a duplicate. Druva forwards us the communications.
05/07/2020 - Tenable tells M. Malvica that we will credit him for independent discovery. Asks how he would like to be acknowledged.
05/07/2020 - M. Malvica asks to be acknowledged as such: “Matteo Malvica from mnemonic”.
05/07/2020 - Tenable sends M. Malvica our disclosure policy and anticipated disclosure date (which Druva has already communicated as well).
05/07/2020 - M. Malvica says he will publish a blog post once the fix is disclosed. Asks for CVE ID.
05/07/2020 - Tenable shares CVE ID.
05/11/2020 - Tenable thanks Druva for sharing the information.
05/11/2020 - M. Malvica shares a URL for his blog post. Asks for an update on patch availability.
05/11/2020 - Tenable has not heard anything from Druva. Will let Malvica know if we get any updates.
05/18/2020 - Tenable asks if Druva will be able to make the disclosure date, 5/25.
05/18/2020 - Druva will release a patch May 21.
05/18/2020 - Tenable acknowledges. We will assign CVE-2020-5752 for this, and issue an advisory.
05/19/2020 - Tenable let's M. Malvica know of the planned release date. But also says we will hold off if the patch is not released on the 21st.
05/20/2020 - M. Malvica asks if we have a pre-allocated link for our research advisory. Also says his blog post will be on a company website.
05/20/2020 - Tenable communicates planned research advisory URL.