Attempting to report a vulnerability

[ericchiang]

I've reached out privately but so far got no response. Can you please enable private reporting or some other mechanism to provide a report?

https://docs.github.com/en/code-security/how-tos/report-and-fix-vulnerabilities/configure-vulnerability-reporting/configuring-private-vulnerability-reporting-for-a-repository

[ericchiang]

friendly ping @jphenow, @Zogoo, @taketo1113

[taketo1113]

I am not a maintainer, so I cannot change the repository settings.

@jphenow Would it be possible for you to enable "Private vulnerability reporting" in the repository settings?

[ericchiang]

Since there doesn't appear to be a means of reporting privately, I plan on publishing this research next week. @taketo1113 if you'd like me to send you a copy beforehand I'm happy to do that.

[Zogoo]

@ericchiang
Hey, thanks for reaching out to us. And I'm sorry for the delayed reply.
I'm not an admin of the repo. Can you report it for my fork repo instead?
https://github.com/Zogoo/saml_idp

[ericchiang]

Thanks! I've opened https://github.com/Zogoo/saml_idp/security/advisories/GHSA-wrc6-gpcc-h84x

[jphenow]

Hello. I'm on paternity leave. I'm also not paid to maintain this so my ability to give it much of my attention is low. I've tried to responsibly hand it off several times with poor experiences. I will try to enable today if I get a chance.

Edit: done

[ericchiang]

Thanks so much @jphenow and congratulations! Amusingly I'm also on pat leave. Hope you're getting some sleep 🫠

I went ahead and opened my finding here: https://github.com/saml-idp/saml_idp/security/advisories/GHSA-5w9q-v6mm-9m4g

[Zogoo]

@jphenow I cannot access this link, but I could see the context in my private repo.