Security issue with checkpoint - vpn

[jflemingeds]

sk106162 - Jumbo hotfix for R77.30 - "PMTR-35032, PRJ-99 VPN Important security update for IPSec Site-to-Site (S2S) VPN."

sk116380 - Jumbo hotfix for R80.10 - "PMTR-35032 VPN Important security update for IPSec Site-to-Site (S2S) VPN."

sk149892 - Unauthorized VPN access to internal networks via IKEv2 tunnel (CVE-2019-8456)

nothing points to PMTR or PRJ in sk14892, granted does say R80.10 take 203 which is where PMTR is so that must be it (why is this so hard?).

I called support and asked "what the *bleep* does important security update for IPSec Site-to-Site (S2S) VPN mean? I didn't know about sk149892 at this time. I pointed out this is really irresponsible to post a security issue in a jumbo hotfix without any details. Diamond support said they've been told they're not going to provide any information on the issue. Not even a severity level for the security issues and since there is nothing for them to do they're going to close the case. The tech did say he thought if it was a big enough deal checkpoint would post something. I was also told to check with my SE to see if maybe they can get more information.

So today I found SK149892 which says it only effects R80.10 and R80.20 and even goes as far as saying

"R77.x versions are not affected since they use a different code." and yet it has the same dev code plus an additional one?

So.. uh.. zero warm fuzzys but hey, maybe the sales team knows something? Thanks thats awesome. Anyone have any idea what the proper channel is to get information about security issues?