I have a vulnerability in Jackett to report and would rather not do it in a public issue, because it discloses stored third-party credentials and there is a working reproduction.
Private vulnerability reporting is not enabled on this repository (/repos/Jackett/Jackett/private-vulnerability-reporting returns enabled: false) and there is no SECURITY.md, so I could not find a private channel to use.
Could you either enable GitHub's private vulnerability reporting — Settings, Advanced Security, "Private vulnerability reporting" — or point me at an address to send it to? I will send the full write-up there.
What I can say without giving it away: it concerns the default configuration on Linux, an unauthenticated request, and a stored credential that is encrypted on disk but not in the response. Reproduced end to end against v0.24.2644.0 in a default container, with request and response captured, and with a negative control.
Happy to wait as long as you need once I have somewhere to send it.
I have a vulnerability in Jackett to report and would rather not do it in a public issue, because it discloses stored third-party credentials and there is a working reproduction.
Private vulnerability reporting is not enabled on this repository (
/repos/Jackett/Jackett/private-vulnerability-reportingreturnsenabled: false) and there is noSECURITY.md, so I could not find a private channel to use.Could you either enable GitHub's private vulnerability reporting — Settings, Advanced Security, "Private vulnerability reporting" — or point me at an address to send it to? I will send the full write-up there.
What I can say without giving it away: it concerns the default configuration on Linux, an unauthenticated request, and a stored credential that is encrypted on disk but not in the response. Reproduced end to end against
v0.24.2644.0in a default container, with request and response captured, and with a negative control.Happy to wait as long as you need once I have somewhere to send it.