-
Notifications
You must be signed in to change notification settings - Fork 251
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Who to contact for security issues #244
Comments
Just for reference, the report can be found here: It is private and only accessible to maintainers with repository write permissions 👍 |
(cc) @rexxars 👆 |
Hi, sorry for hijacking this issue but could you please take a look at approving v1.1.1 for fixing the above mentioned issue too? I am using a tool called snyk and the CVE seems to now acknowledge version 1.1.1 to contain the fix just yet. |
Do you know how I could go about doing so? |
@rexxars - I might be able to help here. If you can confirm that See: |
Sorry, but I'm not familiar with this process at all :( Jamie seems to be able to assist with it though 💯 |
Hi Jamie,
Just to make sure: we are discussing about the fix bounty here and not the vulnerability finding.
Both of these versions where not out when I wrote the report 3 months ago, and at that time the latest version was vulnerable to what I have described in the POC.
With best regards,
Timothee
Get BlueMail for Android<https://bluemail.me>
On May 20, 2022, at 18:32, jhspinpanel ***@***.******@***.***>> wrote:
could you please take a look at approving v1.1.1 for fixing the above mentioned issue too?
Do you know how I could go about doing so?
Sorry, but I'm not familiar with this process at all :( Jamie seems to be able to assist with it though 💯
—
Reply to this email directly, view it on GitHub<#244 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AJTI33JGR5GU2DPV2CGWZW3VK6PALANCNFSM5NYTFOAA>.
You are receiving this because you were mentioned.Message ID: ***@***.***>
|
To summarize:
This ensures that people do not have to upgrade to v2 if they are stuck on the v1 range, due to needing support for node 12 or below, or similar. Would be great if you could update the CVE. |
Hey there!
I belong to an open source security research community, and a member (@Sampaguitas) has found an issue, but doesn’t know the best way to disclose it.
If not a hassle, might you kindly add a
SECURITY.md
file with an email, or another contact method? GitHub recommends this best practice to ensure security issues are responsibly disclosed, and it would serve as a simple instruction for security researchers in the future.Thank you for your consideration, and I look forward to hearing from you!
(cc @huntr-helper)
The text was updated successfully, but these errors were encountered: