If I find a security issue in a Github project should I raise it in the project's issue tracker (where it's open to public scrutiny) or try to find private means to contact the repo's maintainer so that action can be taken before the issue is exposed to public scrutiny?
-
1This is actually a really interesting situation you got there. Problem is however, if the projects maintainer pushes a fix, chances are still high that attackers might latch on and still perform the attack on people that haven't upgraded. This will not however, be on your conscious, but on the project maintainer and the client.– MartijnCommented Oct 12, 2015 at 16:57
-
1That's true but I guess all projects face that issue - look at node recently they patched a security hole and had to release the update then ask users to apply the update...same with shellshock etc– br3w5Commented Oct 12, 2015 at 17:22
-
You can retrieve most GitHub contributors' email address with this method.– sondra.kinseyCommented Apr 12, 2019 at 17:41
Add a comment
|
4 Answers
There is, as far as I know, currently no way to mark an issue as a security issue. That makes reporting a security issue including full details on GitHub effectively a full disclosure strategy.
Different people support different ways of disclosure of security issues, and full disclosure is a valid choice.
However, if you don't want to go the full disclosure route, reporting an issue on GitHub which includes full details of the vulnerability is not possible.
You could choose to
- Follow instructions for security vulnerabilities, if there are any
- File an issue with your findings and a request to get in to contact
- Find other means to contact the maintainer
The choice is yours.
-
9Thanks I've raised an issue without any disclosure details and asked for a contact to go through it privately before adding anything else to github– br3w5Commented Oct 12, 2015 at 11:34
-
5As a maintainer, I would much prefer you send that kind of issue privately, through our contact address. Of course, if the project doesn't have one, you've little choice but to publicly disclose it through the issue tracker. Commented Oct 12, 2015 at 16:04
-
3@RubberDuck If the project is on Github, then it has a Git repos by definition. And normally the addresses used in a VCS repository are valid email addresses. So one can write to those addresses. Commented Nov 1, 2015 at 13:03
-
Fantastic point @FaheemMitha. I believe that was pointed out elsewhere around here somewhere. Commented Nov 1, 2015 at 13:09
All issues on Github are public. So, if the issue is one that is fine to disclose publicly, you could report it via the issue tracker.
However, as a general default, I would suggest trying to report the issue privately. I can suggest two options:
Look for a contact address for the maintainer. Perhaps if you are lucky it will be listed on the project web page. You can also use
git logto see if an email address appears there.If you cannot find a contact address, post a new issue on the issue tracker that says "I have a security vulnerability to report. How would you like me to report it? Please provide the appropriate contact information or instructions for where to report it." Then, wait for the maintainer to get back to you and describe how they'd like the issue to be reported.
-
1good point often a contact email is in the authors section of
package.json– br3w5Commented Oct 12, 2015 at 17:22
This is an old issue, but GitHub now recommends you to open a new issue on the related repository to ask for a preferred security contact:
If there isn't a security policy in place, the most efficient way to establish a private means of communication with maintainers is to create an issue asking for a preferred security contact. It's worth noting that the issue will be immediately publicly visible, so it should not include any information about the bug. Once communication is established, you can suggest the maintainers define a security policy for future use.
If the project has enabled private vulnerability reporting you can create a private repository advisory directly in GitHub.
