Request Security tab

[geonhomin]

Hello,

I am currently studying the source code of this project with a focus on security.

While I have not identified any vulnerabilities yet, I noticed that this repository does not currently have Private Vulnerability Reporting enabled. Without this feature, security researchers often face a dilemma: posting a potential exploit in a public issue (which puts users at risk) or struggling to find the correct contact email.

I highly recommend enabling the "Private vulnerability reporting" feature provided by GitHub.
This feature allows researchers to report security issues directly to the maintainers within GitHub's UI, keeping the details private until a patch is ready. It creates a safe channel for collaboration without exposing the vulnerability to the public.

Setting this up beforehand would be very helpful for me (and other researchers) to responsibly report any findings in the future.

Thank you for your hard work on this project!

[geonhomin]

I understand you are very busy, but I would like to responsibly report a vulnerability I have identified.
I believe that sharing this information and working together on a fix can help make busybox even safer for all users.

If the issue is confirmed and coordinated through the appropriate process, obtaining a CVE identifier would also be beneficial for transparency and for properly documenting the security improvement.

My intention is to contribute positively to the project and to collaborate in a constructive manner.
Thank you very much for your time and for all the work you do on Busybox.

[CodeAsm]

try http://www.busybox.net/FAQ.html#bugs
or https://bugs.busybox.net/

this repo is only a mirror and probably not looked at by the developers. Is your reply partially generated by AI? if not, well written 😄

[geonhomin]

@CodeAsm
I discovered a vulnerability in BusyBox and received a CVE assignment from MITRE.
Now I want to complete the responsible disclosure process: report the vulnerability,
request a patch, and then activate the CVE number.

I have no bad intentions whatsoever. I simply want to have my research and work
recognized. This is an experience I'd like to have as part of my learning journey.
It's not about money - I want to receive my own CVE number, learn from the process,
and gain valuable experience.

However, I'm not sure where to report the vulnerability to request a patch and
activate the CVE number. If you have any guidance on this process, I would greatly
appreciate your advice.

try http://www.busybox.net/FAQ.html#bugs
or https://bugs.busybox.net/

this link, keep in loading. do not connection. thank you.

[CodeAsm]

Sorry, try https://lists.busybox.net/mailman/listinfo/busybox (which seems to be up, while the rest is down)
the traditional irc tho https://lists.busybox.net/pipermail/busybox-cvs/2014-February/034417.html #busybox IRC channel on irc.freenode.net.
seens to be pretty deserted and none of their names popup.

its what i can find. if its a serious issue, maybe some linux distro that distributes busybox, might be intrested in forwarding or fixing your CVE and push the fix forward.

[geonhomin]

thank you for your advice

[robang74]

I discovered a vulnerability in BusyBox and received a CVE assignment from MITRE.
Now I want to complete the responsible disclosure process: report the vulnerability,
request a patch, and then activate the CVE number.

• https://github.com/robang74/busybox