Who to contact for security issues

[JamieSlome]

Hey there!

I belong to an open source security research community, and a member (@Sampaguitas) has found an issue, but doesn’t know the best way to disclose it.

If not a hassle, might you kindly add a SECURITY.md file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.

Thank you for your consideration, and I look forward to hearing from you!

(cc @huntr-helper)

[JamieSlome]

Just for reference, the report can be found here:
https://huntr.dev/bounties/dc9e467f-be5d-4945-867d-1044d27e9b8e/

It is private and only accessible to maintainers with repository write permissions 👍

[JamieSlome]

(cc) @rexxars 👆

[ghost]

Hi, sorry for hijacking this issue but could you please take a look at approving v1.1.1 for fixing the above mentioned issue too? I am using a tool called snyk and the CVE seems to now acknowledge version 1.1.1 to contain the fix just yet.

[rexxars]

could you please take a look at approving v1.1.1 for fixing the above mentioned issue too?

Do you know how I could go about doing so?

[JamieSlome]

@rexxars - I might be able to help here. If you can confirm that v1.1.1 is not affected by this, I can update the CVE 👍

See:
https://github.com/418sec/cvelist/blob/master/2022/1xxx/CVE-2022-1650.json

[ghost]

could you please take a look at approving v1.1.1 for fixing the above mentioned issue too?

Do you know how I could go about doing so?

Sorry, but I'm not familiar with this process at all :( Jamie seems to be able to assist with it though 💯

[Sampaguitas]

Hi Jamie, Just to make sure: we are discussing about the fix bounty here and not the vulnerability finding. Both of these versions where not out when I wrote the report 3 months ago, and at that time the latest version was vulnerable to what I have described in the POC. With best regards, Timothee Get BlueMail for Android<https://bluemail.me> On May 20, 2022, at 18:32, jhspinpanel ***@***.******@***.***>> wrote: could you please take a look at approving v1.1.1 for fixing the above mentioned issue too? Do you know how I could go about doing so? Sorry, but I'm not familiar with this process at all :( Jamie seems to be able to assist with it though 💯 — Reply to this email directly, view it on GitHub<#244 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AJTI33JGR5GU2DPV2CGWZW3VK6PALANCNFSM5NYTFOAA>. You are receiving this because you were mentioned.Message ID: ***@***.***>

[rexxars]

@rexxars - I might be able to help here. If you can confirm that v1.1.1 is not affected by this, I can update the CVE 👍

See: https://github.com/418sec/cvelist/blob/master/2022/1xxx/CVE-2022-1650.json

To summarize:

• v1.1.0 and below are affected by this issue - the issue is fixed in v1.1.1.
• v2.0.0 and v2.0.1 are affected by this issue - the issue is fixed in v2.0.2.

This ensures that people do not have to upgrade to v2 if they are stuck on the v1 range, due to needing support for node 12 or below, or similar.

Would be great if you could update the CVE.

[JamieSlome]

@rexxars - sorted:

https://github.com/CVEProject/cvelist/pull/5853/files