Where should security issues with GNU ELPA packages be reported?

Where should security issues with GNU ELPA packages be reported?

[Morgan Willcock]

I think I have found a security issue with a package which is
distributed on GNU ELPA, and I am unsure who to notify.

Given that the package is technically part of Emacs, do I follow
whatever the procedure would be for disclosing security problems with
Emacs?  If so, what is that procedure?

Or should I e-mail the package author first?

Given that it is not the package author who is distributing the package,
I am unsure what to do.

-- 
Morgan Willcock

Re: Where should security issues with GNU ELPA packages be reported?

[Emanuel Berg]

Morgan Willcock wrote:

> I think I have found a security issue with a package which
> is distributed on GNU ELPA, and I am unsure who to notify.
>
> Given that the package is technically part of Emacs, do
> I follow whatever the procedure would be for disclosing
> security problems with Emacs? If so, what is that procedure?
>
> Or should I e-mail the package author first?

Good idea, after that you can post here or use
`report-emacs-bug'.

-- 
underground experts united
https://dataswamp.org/~incal

Re: Where should security issues with GNU ELPA packages be reported?

[Philip Kaludercic]

Morgan Willcock <morgan@ice9.digital> writes:

> I think I have found a security issue with a package which is
> distributed on GNU ELPA, and I am unsure who to notify.
>
> Given that the package is technically part of Emacs, do I follow
> whatever the procedure would be for disclosing security problems with
> Emacs?  If so, what is that procedure?
>
> Or should I e-mail the package author first?
>
> Given that it is not the package author who is distributing the package,
> I am unsure what to do.

It would probably be better to message the maintainer first, if there is
no explicit maintainer you can check elpa.git to infer who is
responsible.  Can you disclose what package you are concerned about?

-- 
	Philip Kaludercic on peregrine

Re: Where should security issues with GNU ELPA packages be reported?

[Morgan Willcock]

Philip Kaludercic <philipk@posteo.net> writes:

> Morgan Willcock <morgan@ice9.digital> writes:
>
>> I think I have found a security issue with a package which is
>> distributed on GNU ELPA, and I am unsure who to notify.
>>
>> Given that the package is technically part of Emacs, do I follow
>> whatever the procedure would be for disclosing security problems with
>> Emacs?  If so, what is that procedure?
>>
>> Or should I e-mail the package author first?
>>
>> Given that it is not the package author who is distributing the package,
>> I am unsure what to do.
>
> It would probably be better to message the maintainer first, if there is
> no explicit maintainer you can check elpa.git to infer who is
> responsible.

There is an e-mail address for the maintainer, I just wasn't sure
whether going to them first was the correct thing to do.

> Can you disclose what package you are concerned about?

I was not planning on naming it until after I had spoken privately to
whoever the appropriate person is.  The problem concerns an encryption
failure which potentially exposes private security keys.

-- 
Morgan Willcock

Re: Where should security issues with GNU ELPA packages be reported?

[Philip Kaludercic]

Morgan Willcock <morgan@ice9.digital> writes:

> Philip Kaludercic <philipk@posteo.net> writes:
>
>> Morgan Willcock <morgan@ice9.digital> writes:
>>
>>> I think I have found a security issue with a package which is
>>> distributed on GNU ELPA, and I am unsure who to notify.
>>>
>>> Given that the package is technically part of Emacs, do I follow
>>> whatever the procedure would be for disclosing security problems with
>>> Emacs?  If so, what is that procedure?
>>>
>>> Or should I e-mail the package author first?
>>>
>>> Given that it is not the package author who is distributing the package,
>>> I am unsure what to do.
>>
>> It would probably be better to message the maintainer first, if there is
>> no explicit maintainer you can check elpa.git to infer who is
>> responsible.
>
> There is an e-mail address for the maintainer, I just wasn't sure
> whether going to them first was the correct thing to do.

The maintainer of the package can generally push changes to their own
repository and can trigger a new package to be built.  If they do not
respond and it is urgent, anyone with access to elpa.git could push a
commit to the mirror (forking from upstream).

>> Can you disclose what package you are concerned about?
>
> I was not planning on naming it until after I had spoken privately to
> whoever the appropriate person is.  The problem concerns an encryption
> failure which potentially exposes private security keys.

Ok, understandable.

-- 
	Philip Kaludercic on peregrine

Re: Where should security issues with GNU ELPA packages be reported?

[Richard Stallman]

[[[ To any NSA and FBI agents reading my email: please consider    ]]]
[[[ whether defending the US Constitution against all enemies,     ]]]
[[[ foreign or domestic, requires you to follow Snowden's example. ]]]

If a package in NonGNU ELPA as a security problem that is important
enough, we can take action ourselves -- either to fix it ourselves in
a hurry, or to remove it from NonGNU ELPA until its developers fix it.

-- 
Dr Richard Stallman (https://stallman.org)
Chief GNUisance of the GNU Project (https://gnu.org)
Founder, Free Software Foundation (https://fsf.org)
Internet Hall-of-Famer (https://internethalloffame.org)