[BUG]: Security Concern

[avioligo]

Bug description

Hi! I believe I've identified a security concern that requires immediate attention.
The SECURITY page in this repo does not state how vulnerabilities should be reported, neither the docs or the code itself.

Is there a security contact for this project that I can share the report with, in private, rather than opening a public Issue?

Thanks in advance.

Steps to reproduce

Will be provided in private.

System information

[avioligo]

Hey @JoeLoser Any update? Is there anyone in charge of Modular's security?

[JoeLoser]

Hey @JoeLoser Any update? Is there anyone in charge of Modular's security?

I brought this to the attention of our security team internally yesterday. If you don't mind, please consider filling out the security form at https://www.modular.com/company/report-issue.

FYI @dlumma

[dlumma]

Yes, please submit to us privately here: https://www.modular.com/company/report-issue

[avioligo]

Hey @dlumma @JoeLoser - Per your request, I have reported it privately.
But 3 weeks have passed, and I did not get a confirmation or response at all.

Can you please let me know if you have received it, and are actively working on it, or not?
We have reasons to believe it is critical and places your users at risk. I kindly request your assistance in looking into it or clarifying where it stands.

Thanks in advance.

[dlumma]

Thank you, received and an update is in progress.

[avioligo]

Hey @dlumma - any update on this issue?
AWS is asking for the information as well as they are impacted by it.
I have not seen a CVE.

Thanks.

[dlumma]

The team has landed a proposed fix here: 1062005

Thank you!

[avioligo]

@dlumma Hey, thanks for the update, I just wanted to confirm the fixed version is Modular 25.5 from August 5th?
I could not find this change it in the changelog, so I wanted to clarify which version includes the fix.
Thanks!