PicoTCP-NG — responsible disclosure of security issues

[fralasp]

Hello,

We've identified several security issues in PicoTCP-NG 2.1 (virtualsquare/picotcp) that we'd like to report responsibly. Could you let us know the preferred contact for security disclosures?

Thank you.

Kind regards,
Francesco

[danielinux]

Hi,
Since this is now voluntatily maintained by a group of people, I think the best way would be to create a private advisory here. I've enabled github security advisories for you to report your findings.

Thanks,

d

[fralasp]

Hi, I reported all the security issues, can you confirm you see them? Thanks

[scribam]

🤔 I don't see anything. Do you have something @danielinux? From my understanding, it should be visible here: https://github.com/virtualsquare/picotcp/security/advisories

[danielinux]

I see the reports. I'm going to double check permissions.

[danielinux]

@scribam please check again

[scribam]

@danielinux still nothing 😕 In fact, I am more restricted now than before your changes 😅

[danielinux]

@scribam very sorry about this. I've moved you to "Maintainer". Please let me know if anything changed

[scribam]

@danielinux Thanks! I have the previous access back. AFAIK, the "Maintainer" role can not read security advisories only "Admin" can. An alternative would be to add me manually to the advisories: https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/fix-reported-vulnerabilities/add-collaborators

[danielinux]

@scribam I had to add you to each single one.

[scribam]

Thanks @danielinux, I confirm I have access to them 👍

[danielinux]

I don't have bandwidth to address any of those, but let me know if I can assist with reviewing/ releasing once you're ready to push
the fixes.