How to report a security issue privately?

[joszamama]

Hi, I found a security issue in ttf-parser. I don't see a SECURITY.md or private vulnerability reporting enabled on the repo. Is there a secure way to share the details with you, e.g. a security email or turning on GitHub private vulnerability reporting? Thanks.

[RazrFalcon]

This library forbids unsafe, so I can only imagine it's either an integer overflow or an endless loop. Both a fine to report as a regular issue.

[joszamama]

Thanks for the quick response!

It actually turns out to be an algorithmic-complexity issue (CWE-407) that bypasses some already implemented guards, causing exponential CPU usage rather than an endless loop or overflow. Because it has broader DoS implications for projects using the library, I'd prefer to share the reproduction files and details privately.

[joszamama]

(I am just taking extra caution because if it turns out to be a confirmed CWE-407, these usually take some time to be fixed, due to system/algorithmic rewrites)

[RazrFalcon]

Well, the library is currently unmaintained/abandoned. So unless you would send a patch as well it will not be fixed 🫠

[joszamama]

I'm always happy to contribute to and iterate on security issues together with the maintainers, so I'd rather work this through with you than just file and move on. That said, since the crate is unmaintained, my responsible-disclosure fallback would simply be a RustSec report noting the affected versions.

If you want to take a look, just let me know. Otherwise, I will report it in RustSec and move on. Thanks!

[alerque]

Please feel free to email me privately with any details. I tend to agree with the initial assessment that a public reporting of details would have been preferred in this case, but in any event I'd like to review whether this report is one that aligns with recent contributions claiming to fix a security issue. So far I don't see enough information to even know if this is about the same issue or not.

My email is found in the Cargo manifest, and you can confirm I'm the last releaser on crates.io. My GPG public keys are easy enough to find, although since I'm on the side of this info being public obviously I'm not too concerned about the transmission being encrypted ;-)