Security issue reporting mechanism

Security issue reporting mechanism

[Mark Wielaard]

Hi gdb hackers,

Because we approve bugzilla account requests we (sourceware overseers,
specifically the admin-requests team) get contacted from time to time
by people wanting to report what they believe is a security issue in
GDB.

Although the top-level SECURITY.txt says to look under the gdb
directory for a similarly named file, there is no such file:
https://sourceware.org/cgit/binutils-gdb/tree/SECURITY.txt

For now we have each time briefly discussed such issues on
irc.libera.chat in the #gdb channel to see how people feel about
forwarding a report to either the binutils team, just ask people to
report the issue publicly in bugzilla or ask the reporter to contact
secalert@redhat.com (which has a good reputation for handling and
coordinating such things with the other distros).

But it would be much more efficient if GDB could have a documented
security issue reporting mechanism and document what kind of issues
they consider just bugs that can be reported publicly.

You could take a look at binutils or elfutils for inspiration:
https://sourceware.org/cgit/binutils-gdb/tree/binutils/SECURITY.txt
https://sourceware.org/cgit/elfutils/tree/SECURITY

Cheers,

Mark