[ecd-pmc] CVE Request

[Wayne Beaton <wayne.beaton@xxxxxxxxxxxxxxxxxxxxxx>]

Greetings PMC. I require your assistance.

Please see Bug 551596. This bug, which is currently marked "committers-only", describes a vulnerability (the 90 day window for disclosure is approaching). That vulnerability has been patched by the project team, but requests from the reporter to have the vulnerability disclosed as a CVE have no response. I believe that the project team may require some assistance. I've provided some generic guidance, but without detailed knowledge of the problem, it's difficult for me to be more specific.

The handbook provides guidance regarding how to actually engage.

https://www.eclipse.org/projects/handbook/#vulnerability-cve

Thanks for your assistance in this matter.

In a related topic, I believe that having representation of the ECD PMC on the Security Team (so that a member of the PMC will be able to respond to messages regarding ECD projects) would be of incredible value to your community.

Wayne

--

Wayne Beaton

Director of Open Source Projects | Eclipse Foundation, Inc.