From predisclosure-applications-bounces@lists.xenproject.org Fri May 29 09:07:10 2026 Return-path: Envelope-to: archives@lists.xenproject.org Delivery-date: Fri, 29 May 2026 09:07:10 +0000 Received: from list by lists.xenproject.org with outflank-mailman.1321597.1588336 (Exim 4.92) (envelope-from ) id 1wStBM-0005QE-Em; Fri, 29 May 2026 09:07:08 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 1321597.1588336; Fri, 29 May 2026 09:07:08 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wStBM-0005QA-An; Fri, 29 May 2026 09:07:08 +0000 Received: by outflank-mailman (input) for mailman id 1321597; Thu, 28 May 2026 17:00:33 +0000 Received: from mx.expurgate.net ([195.190.135.10]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1wSe5w-0007rR-MD for predisclosure-applications@lists.xenproject.org; Thu, 28 May 2026 17:00:33 +0000 Received: from mx.expurgate.net (helo=localhost) by mx.expurgate.net with esmtp id 1wSe5u-00BDux-DN for predisclosure-applications@lists.xenproject.org; Thu, 28 May 2026 19:00:30 +0200 Received: from [10.42.69.1] (helo=localhost) by localhost with ESMTP (eXpurgate MTA 0.9.1) (envelope-from ) id 6a1874ad-5cb7-0a2a0a5109dd-0a2a45019594-0 for ; Thu, 28 May 2026 19:00:29 +0200 Received: from [148.163.154.146] (helo=mx0b-002b1501.pphosted.com) by tlsNG-d62444.mxtls.expurgate.net with ESMTPS (eXpurgate 4.56.1) (envelope-from ) id 6a1874ab-c1f2-0a2a45010019-94a39a923d4a-3 for ; Thu, 28 May 2026 19:00:28 +0200 Received: from pps.filterd (m0119679.ppops.net [127.0.0.1]) by mx0b-002b1501.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 64SC8Fej1812894; Thu, 28 May 2026 12:00:26 -0500 Received: from bn8pr05cu002.outbound.protection.outlook.com (mail-eastus2azon11011013.outbound.protection.outlook.com [52.101.57.13]) by mx0b-002b1501.pphosted.com (PPS) with ESMTPS id 4ee7whatu7-1 (version=TLSv1.3 cipher=TLS_AES_256_GCM_SHA384 bits=256 verify=NOT); Thu, 28 May 2026 12:00:25 -0500 (CDT) Received: from PH7PR17MB7026.namprd17.prod.outlook.com (2603:10b6:510:236::18) by DS0PR17MB6231.namprd17.prod.outlook.com (2603:10b6:8:136::21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.71.12; Thu, 28 May 2026 17:00:23 +0000 Received: from PH7PR17MB7026.namprd17.prod.outlook.com ([fe80::a046:9950:946c:14dd]) by PH7PR17MB7026.namprd17.prod.outlook.com ([fe80::a046:9950:946c:14dd%3]) with mapi id 15.21.0071.011; Thu, 28 May 2026 17:00:23 +0000 X-BeenThere: predisclosure-applications@lists.xenproject.org List-Id: Applications for membership of Xen Security Advisories Pre-disclosure List List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: predisclosure-applications-bounces@lists.xenproject.org Precedence: list Sender: "Predisclosure-applications" Authentication-Results: eu.smtp.expurgate.cloud; dkim=pass header.s=2k25 header.d=epic.com header.i="@epic.com" header.h="CC:Content-Type:Date:From:Message-ID:MIME-Version:Subject:To"; dkim=pass header.s=selector1 header.d=epic.com header.i="@epic.com" header.h="From:Date:Subject:Message-ID:Content-Type:MIME-Version:x-ms-exchange-senderadcheck" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=epic.com; h=cc :content-type:date:from:message-id:mime-version:subject:to; s= 2k25; bh=yCqfavxxQTiQJ9isH6vgQLSnkCEjPnRmbT3HyWEgcRo=; b=PoFrp6A jh8x0zzs1sdT+ha6OA5GQbRfrjOyUoZxBvBaf37WGQeIg1qirC1RhHSP7KPYakzm zcfwAh7UYSdsGaV5Ph5LpTnjd7P8GqqIDEAY4OJKqeXCaFlrZ7kz4V7py+07682E QusI1zpjoGe5/mKUh8mmsSdVWKc+VBGAflAaMYUTNu1vZSdrdertJr55+fXnjp7Q ZYEh7XgoWbhDX6Ux818kEUpEEN9v/mN2s3PPYXSIbhPCGvvvWKny0RpKmh17cZ6k 933qRmsU538dduMJx1tjdrKTjEYK4rOvmiyKISLJfk0/qlhKsKQzbX551JrHOCN7 JUU+IlYaJ5SM0hA== ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=I6v4VtHjr4Fpvr+q2WF/NzPFOsYNNkAPA6GRgIulwsArVxmt3Je+S0YuzyZOnqW1pzvkW1Ff+nn2OkfvT4gBWHWnVPCOViqRIBbdmn2P527kJv1svSpjh4uZAKVchTdXma+5a0+eUJgLEizy12ppZt2xj/Pmp7hV1YNvdB55YW8QbJDoq/oceNQeXZELl91rnEO35/x8odxA9aqSZyLHOc0zyzzHa0SU3cVM/h5/qJ1ATtFYoBIBWWE9WjJAHm85Lxkyxo611cCozmfJ/gINYiJ0jlBYscUd+OLl4EaPyS0dv3scFCnpAmuRmTMI6XsG0jgP4wL3VhSmczIYBYlv7A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=yCqfavxxQTiQJ9isH6vgQLSnkCEjPnRmbT3HyWEgcRo=; b=lm1JevJT/mqBQ7zEEjshhoPjdBYzKU44qn6Fy6Xf8jZv0lbZDDogwFlvd8Vqij0rxD9FasXMjN6XN4+DvZkEtVlNj/xr/4qNEMW3z3eCQtmEDJ8Niz0GlZEMxx4MrKfS3au+wDlQ0JysHP0Ab/Ayt8i/P+fFGQbtl7wCjXrH1C+f9LqKrBx54/We0ImjgH/E/BklOTwcIPIzJsd0BSO/5C3RTotUsSrR56xPciLgotYmF5vzF9hbCTvAZt9plEXpOr+36q4l/B6jIYEAI9USu87epBxUlPSZmKLhKgFoSTwwMnhq1EGx7M24BRKR1y4SSc24YgmEdrrIdjyYuLBmMA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=epic.com; dmarc=pass action=none header.from=epic.com; dkim=pass header.d=epic.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=epic.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=yCqfavxxQTiQJ9isH6vgQLSnkCEjPnRmbT3HyWEgcRo=; b=Ktbk/5MyuVdl3liYsxnyKymmSMAkxrtaAtD372ykm1WdKZqZ1aom66Hlsnz7peWMIc38ro0B+V4aEh4UUCHdNilmxE4/NGDflQkRJTSc5zL6c5We8xBy6NOKUqfIBqoGjcq0eGNEAA3UOYKfk8QFNFGk55fFjH4xX9a5Ulz8yIc= From: Jake Vondra To: "predisclosure-applications@lists.xenproject.org" CC: Darryl Voss , "alex.brett@citrix.com" Subject: Epic Hosting - Xen Pre-Disclosure Submission Thread-Topic: Epic Hosting - Xen Pre-Disclosure Submission Thread-Index: AdzuwttRETC9w6WvTPmhZ/dQ5WoDwA== Date: Thu, 28 May 2026 17:00:23 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-ms-publictraffictype: Email x-ms-traffictypediagnostic: PH7PR17MB7026:EE_|DS0PR17MB6231:EE_ x-ms-office365-filtering-correlation-id: 534bd7bf-bab9-4d53-c1e7-08debcda9ba9 x-ms-exchange-senderadcheck: 1 x-ms-exchange-antispam-relay: 0 x-microsoft-antispam: BCL:0;ARA:13230040|376014|366016|1800799024|38070700021|11063799006|3023799007|8096899003|18002099003|13003099007|56012099006; x-microsoft-antispam-message-info: tmoGyVxS4iqD4jU7k/BOhs81INFfA5nnqrBDh9jkbjKTQbBgBVa5YdfHG55cT7qRpCl/i8/7ds0GfEHSE2d6gvFP24nJjm2uqBe2b84qCp0jXFPuGHG2QDTTurRBUwBwS+RflHuRoWz3nhrZPdX+OF0syZT9hcJfyPT01Pq20uwneJLdkex8i1GS3qSHAnwCfic7Chl/+B1q+ACCqnJg81MexjItAlTbs4lpBV0IDvIlbXZDu65F1WJTqPZMlnCDG4EMsgOYxQXsFHjYKp52sXKqnx9BeQV9T/TGvGLsQy32LJjAUDaTPU8B0qd1CNIGgLHKU1PWMYxsFz0+pjlryYf9ur+won05rviQ98r15LqhmcozMxN/75NGPqCszhlCL4v8ht52A2bXtosENJyi3e/R+ZC09KeK/Tznbz1H5PxZXTUnpHJM75ky6xrz27gkMHlTi4FCuw2BQTyNbT94cI70CoRH5wczIbv5vUtPAiYSTwKvxM7vY4g9Ad7+EbBGpwa5I+xP2FLngtIlKBfbZq+FICIAa0osHy26yVKpNS2LFKbHRUa1HGGNDtyw+TmWpzKoHYtXCvqQu8Gli9zySYmR+ncFdGSC+cJH3ug4icWrZW6ps6aw3zUHBljGV4o1Eac6hCWlRrU5Z21/dixvj2BnqTY+XbbLtD0LV8RWt1JlnlGGvkJINmRvD+SKEWhag4jUVG+mx0s4B8XPkM7/IA== x-forefront-antispam-report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:PH7PR17MB7026.namprd17.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(366016)(1800799024)(38070700021)(11063799006)(3023799007)(8096899003)(18002099003)(13003099007)(56012099006);DIR:OUT;SFP:1101; x-ms-exchange-antispam-messagedata-chunkcount: 1 x-ms-exchange-antispam-messagedata-0: =?iso-8859-1?Q?gDyxcFmSojn32lAzfoKoW01K0Mbnp2ddJp3PniFrXaBTz+Iv1LqraPslTl?= =?iso-8859-1?Q?28UcP/Dn1iYCqz/MMksWZ+jvtgX3rtouAV/mmnme0ktRecbYnUdN4SdX/v?= =?iso-8859-1?Q?+vhxOxOxaDqO2UQLN+vTBPKs3mnkAoYVGOuTB1OI7aWeIz30/3lQOK+GFd?= =?iso-8859-1?Q?B2DFRNQIp94kDxeAs5gY9N3+UMjPpemeGrOvYYYCYQhsNcxbCD0VWRsn/N?= =?iso-8859-1?Q?H1sZMnK3FUKECNws+yvimNJRwd/JZtO1kLPkG1SGEUeqXx+8Rwp1JEPxk2?= =?iso-8859-1?Q?Tng/qf9KVDCdxNW5wts9VXXGbyhYXiQb1HiBsCkFHtLolIa6B8e5A/y8ri?= =?iso-8859-1?Q?fL0Iqgb3QiR3dM/hF9cW2GsSiWcbeAcz1OIpqORJLRPzFXbbfGowIGoTkk?= =?iso-8859-1?Q?mG3ePivbjMRKJgCLX+g1uq/ctpjJlfQ5HK2/Tfy9/lgqQP0Tg2U0OE3twC?= =?iso-8859-1?Q?y+9upEt6D9ztZhFFULaVF0H3qYepobV5cJsn8roHuldzQKoVvvKpD2YBkN?= =?iso-8859-1?Q?NF+tuzOi9f/FXxPgjICGejwtm6QT2suoGDiMaEUOSaHai5q5fJ+PIAdqVB?= =?iso-8859-1?Q?Jbih+Tha6cl2At4DKPVFNtijR4tabH5QETXCJhiPV1rEF8Yh9aYnBSW+OF?= =?iso-8859-1?Q?Xmk/b9U9Rl4g9E/HoapQ4jnzNz7acNlP7EllYpyYaq5jyKRDIhy2Fj+onO?= =?iso-8859-1?Q?ScP//6LsTVG3fqugQbdDjxyevPqg7lhbfZWUk35wjlUXxUZ6HxiXW1+lGR?= =?iso-8859-1?Q?TeoZ0er9af6hj5ox41NJ5pHdsYsPVCwdwa8R0sM8Ln4H8XPtesk7kkEz5X?= =?iso-8859-1?Q?aLw6uZKr18XIZ9rU2+lZA0TbLWtvaY7mYy5UN2ZD+SDwsW8USCiMr4J0Pc?= =?iso-8859-1?Q?mEzPjbQsD4r3/6Z0P4pMrhnWRzF2FuQyiq1zNzzl/ForoAG0RsltdDqJp2?= =?iso-8859-1?Q?gLRSghOwkO0pqAb/TS2FjODdq6wz0Qz+PhzelbvqIb9M3Z7IRxX744GbeA?= =?iso-8859-1?Q?MpasVOoNVOz4nbQQh5lAKsBf/spvnCVGFPN1j+PZLCMB87W7krOr2eQzHS?= =?iso-8859-1?Q?7aadPpVP77eyQUOdQYMyqD4s3Ucb5Y/gtK+svzRnove/n6oKHMj68cLeHv?= =?iso-8859-1?Q?gM4J1MI0E67PINadukg79o9/+k9CWFqeo8EDksiJdFMQdEFu42NGSWI072?= =?iso-8859-1?Q?zyMoe/XH3sKAxQApy0GDATkYJDOXRAOQC7E7NVOLpBGRSiVcu/OUmDVFje?= =?iso-8859-1?Q?WMmnej/y3Z7mEakdFPUHTLwfx7OV9lLsSSbphKcAPEG+zDOkPhfluz6iD5?= =?iso-8859-1?Q?WTbEaKncwPQeocOegMbjcUzDfOomygDzRDdaU6leJZRuKMNVue1EZkZcut?= =?iso-8859-1?Q?eP7EIckOrdwP4tCj68egLXlp+kD+vZfzhZBF6lzteQq01IsBXiBI3YYFyu?= =?iso-8859-1?Q?MzoKKyJZYUqq3SyD0bKZ1obTPjcaLXWovAlj3kvlPnC2EbFMFuNi6adwF2?= =?iso-8859-1?Q?GrO/KgAj/F1ok6pldjZt/ZZNRyzsgEp7sa9lh5ipIOxF8FvaM2CPqEl1sW?= =?iso-8859-1?Q?ZL03VQ9w3w346INTfjTGjL6LoEo632V0PlV7nZmZHyCfrCT4YSyI1PoMGP?= =?iso-8859-1?Q?xBtVQA0ReJqsb+cSxN8ZoNV0Iap7WI8gRcfe/Q0QMB8hBFQY+fCWmRqLgS?= =?iso-8859-1?Q?DEdWrP30D8QFDtu7IolpVoMEGDhzGimcuX9gOnXHUHAEQCf9M+M2nUp041?= =?iso-8859-1?Q?RVumvTb2UKFWpr7AOeRcDK4ORwe0ehs17XnsFkcCd4dYv7?= Content-Type: multipart/alternative; boundary="_000_PH7PR17MB7026055FE84CA4E46DDE1BEBC0092PH7PR17MB7026namp_" MIME-Version: 1.0 X-Exchange-RoutingPolicyChecked: dUuj/IIb3NhM2nDYeI835Nv+4Y/Rg2y+hh0yyLibuqzH0WOJEpfs4zi6Bq2aOVwWqwJR/trVhaNExGH9p+msb/DF9FQyNalOXH+VeR/VVGmYOBd2jW3+BgcCkLFsQHsNGdEpbp8OBuq/wdMoZatP78A1+tHlx2/YgmkXTGWPj6APYBU+yO5cq4Hhv7iob2w+Z5OMlju/fKOQxNK4dnnXsT037+uVzmo8Dzq9rFKJeKkGW688wJGNEo7gIJqkYSWqPLdKbqWh6sHmiVhmp0H09eFR+Tq3HK01TTMiV5ZrVHrYW/eIvXJUqL6P0jF461UPjVXxJlbL4wWyFwiZCQE7OQ== X-OriginatorOrg: epic.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: PH7PR17MB7026.namprd17.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 534bd7bf-bab9-4d53-c1e7-08debcda9ba9 X-MS-Exchange-CrossTenant-originalarrivaltime: 28 May 2026 17:00:23.3287 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: d8d598e0-2fb2-4605-8514-1967b50e2bd6 X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: YXvW2z7JpHgNuN7hgk5jVB0P5GNu0FotBTgJKav/OM7QCOQFKofbFIw+/Z5mfP85Mw+Ki76eynjMbqHAuk7TmA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: DS0PR17MB6231 X-Proofpoint-ORIG-GUID: dTfR7JGtJ3LV7JWZ3amztHfwwb0NYiiA X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNTI4MDE3MSBTYWx0ZWRfX+l/dl2fJVoXq B5WfVXa9VNXrs2O6CtTmGv9xAC+u8bUPqCY8q2TzPiMzSoVBN33rcT5r2rzJaQb8Vl7OkQ26TDf mXq5ZZWrrx+5KwB+GEsURTM8tv1Cymkxo1oRoeOX9l2droPSM3EqP6Fq3wMqnVlglHiuM3XSfFT A2n/fGicef7yWe/IqOqgK1IyGUqL1tVVL45AWgiPeGElINqUtvD69pdKYZuhdFYkIjN4aD7f1GA jngMx3er096HN8JmxeI10T14eiRA4h+VduptJ5WUMWBJU/TEkXnh333NrSB/RwhTRDGNPiNvhlC /yj1eIpIYaPz6GuN+bgs2BweT3X/NB0+B/NcV41Cqww09JaLKAnVr/OPFcoYy/ZLT4rTXi92TyZ HejhNvb0PiSXf6ey4P+3ViRpCOEWKVrwCiVSaSjHkn+stnZ7rAkyoXXcRtjhfCFp3Vs4XwzvLDT LQVhjhDHATGgX4Kd0Rg== X-Proofpoint-GUID: dTfR7JGtJ3LV7JWZ3amztHfwwb0NYiiA X-Authority-Analysis: v=2.4 cv=V4lNF+ni c=1 sm=1 tr=0 ts=6a1874aa cx=c_pps a=g4bHFsidlxN+L/prI/sWbA==:117 a=z/mQ4Ysz8XfWz/Q5cLBRGdckG28=:19 a=lCpzRmAYbLLaTzLvsPZ7Mbvzbb8=:19 a=xqWC_Br6kY4A:10 a=NGcC8JguVDcA:10 a=fLxXaBswY2kA:10 a=VkNPw1HP01LnGYTKEx00:22 a=HcFE1RN0hNOP7eReKWeE:22 a=gFmlLKb4Aa07gUbaYQt1:22 a=nqngphQYAAAA:8 a=KiA8O_NwAAAA:8 a=GXlsYMYiqhGXY-vyWRcA:9 a=lqcHg5cX4UMA:10 a=wPNLvfGTeEIA:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=vWrzgcSVSFaXOwdeQxoA:9 a=4eJA8ZEoNt1lONcO:21 a=gKO2Hq4RSVkA:10 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=l3Kf0c7r5vjhVLBHvrpp:22 a=E2LB0w4p2F9oaE3r9NTf:22 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 malwarescore=0 suspectscore=0 clxscore=1011 phishscore=0 impostorscore=0 priorityscore=1501 lowpriorityscore=0 spamscore=0 adultscore=0 bulkscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2605210000 definitions=main-2605280171 X-purgate-ID: tlsNG-d62444/1779987629-AC457FF4-B7CAFC04/0/0 X-purgate-type: clean X-purgate-size: 11116 --_000_PH7PR17MB7026055FE84CA4E46DDE1BEBC0092PH7PR17MB7026namp_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable I am writing to request an addition to the Pre-Disclosure program - my resp= onses to the requested prompts are in bold below. * The name of your organization: Epic Hosting LLC * Domain name(s) which you use to provide Xen software/services: epicho= sted.com * A brief description of why you fit the criteria: we are a large scale= enterprise delivering our integrated healthcare software * If not all of your products/services use Xen, a list of (some of) you= r products/services (or categories thereof) which do: we largely deliver th= e application presentation layer via XenServer * Link(s) to current public web pages, belonging to your organisation, = for each of following pieces of information: * Evidence of your status as a service/software provider: https://ww= w.epic.com/ * If you are a public hosting provider, your public rates or how to = get a quote: NA * If you are a software provider, how your software can be downloade= d or purchased: https://www.epic.com/contact/ * If you are an open-source project, a mailing list archive and/or vers= ion control repository, with active development: NA * Evidence of your status as a user/distributor of Xen: NA * Statements about, or descriptions of, your eligible production ser= vices or released software, from which it is immediately evident that they = use Xen. * Information about your handling of security problems: https://www.epi= c.com/epic/page/reporting-potential-security-vulnerability/ * Your invitation to members of the public, who discover security pr= oblems with your products/services, to report them in confidence to you; * Specifically, the contact information (email addresses or other co= ntact instructions) which such a member of the public should use. * A statement to the effect that you have read this policy and agree to= abide by the terms for inclusion in the list, specifically the requirement= s to regarding confidentiality during an embargo period: Acknowledged - thi= s has been reviewed * The single (non-personal) email alias you wish added to the predisclo= sure list: XenServer-Notices@epic.com Regards, Jake Vondra Epic | Hosting | 608-271-9000 --_000_PH7PR17MB7026055FE84CA4E46DDE1BEBC0092PH7PR17MB7026namp_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

I am writing to request an addition to the Pre-Discl= osure program – my responses to the requested prompts are in bold bel= ow.

 

--_000_PH7PR17MB7026055FE84CA4E46DDE1BEBC0092PH7PR17MB7026namp_--