How to report a security issue privately?

[joszamama]

Hi, I found a security issue in ttf-parser. I don't see a SECURITY.md or private vulnerability reporting enabled on the repo. Is there a secure way to share the details with you, e.g. a security email or turning on GitHub private vulnerability reporting? Thanks.

[RazrFalcon]

This library forbids unsafe, so I can only imagine it's either an integer overflow or an endless loop. Both a fine to report as a regular issue.

[joszamama]

Thanks for the quick response!

It actually turns out to be an algorithmic-complexity issue (CWE-407) that bypasses some already implemented guards, causing exponential CPU usage rather than an endless loop or overflow. Because it has broader DoS implications for projects using the library, I'd prefer to share the reproduction files and details privately.

[joszamama]

(I am just taking extra caution because if it turns out to be a confirmed CWE-407, these usually take some time to be fixed, due to system/algorithmic rewrites)

[RazrFalcon]

Well, the library is currently unmaintained/abandoned. So unless you would send a patch as well it will not be fixed 🫠

[joszamama]

I'm always happy to contribute to and iterate on security issues together with the maintainers, so I'd rather work this through with you than just file and move on. That said, since the crate is unmaintained, my responsible-disclosure fallback would simply be a RustSec report noting the affected versions.

If you want to take a look, just let me know. Otherwise, I will report it in RustSec and move on. Thanks!