Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Lack of vulnerability reporting process #529

Open
kkremitzki opened this issue Sep 5, 2024 · 2 comments
Open

Lack of vulnerability reporting process #529

kkremitzki opened this issue Sep 5, 2024 · 2 comments
Labels
acknowledged Coin3d team acknowledges this issue enhancement New feature or request task

Comments

@kkremitzki
Copy link
Member

I was recently contacted by someone who found a vulnerability in the Coin library. They sent me a proof-of-concept, but the underlying issue will need a patch, as well. This raises the issue of needing a process to handle these sorts of disclosures throughout the Coin ecosystem. Sorry @VolkerEnderlein for not creating this issue before the tagging of a new release! Moving forward, I suppose the first thing to do would be for me to share this exploit PoC to those who want to take a stab at making a patch. Thoughts? Anyone else in the org who should be tagged? Perhaps @looooo ?
@VolkerEnderlein
Copy link
Collaborator

VolkerEnderlein commented Sep 5, 2024 •
edited
Loading

Thanks for bringing this up, @kkremitzki. I am not aware that GitHub provides such kind of security channel that can be accessed only by specific maintainers, but I am highly interested in the PoC. Can you mail me the data to volkerenderlein@hotmail.com? That would be very helpful. All maintainers of Coin should be tagged, @veelo @looooo @ggabbiani @WizzerWorks @Renreok and @TheHubbit . Maybe one of them can support us in finding a proper solution for the issue.

@VolkerEnderlein
Copy link
Collaborator

VolkerEnderlein commented Sep 6, 2024 •
edited
Loading

Simply was responding to fast without checking the GitHub documentation. GitHub provides such a feature on a per project base. It can be found under Settings -> Code security and analysis -> Private vulnerability reporting . If enabled the private communication with the maintainers and owners of the repository can be done on the Security tab under category Advisories. Meanwhile I enabled this feature for all top level projects of Coin3D organisation. The feature has not been enabled for repositories used as submodules in top level projects.

For a description of the process see here.

Cheers.

@VolkerEnderlein VolkerEnderlein added enhancement New feature or request task acknowledged Coin3d team acknowledges this issue labels Nov 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
acknowledged Coin3d team acknowledges this issue enhancement New feature or request task
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@kkremitzki @VolkerEnderlein