Please open issues on https://github.com/plougher/squashfs-tools/issues
Do NOT send security issues to any of my private email addresses (phillip@squashfs.org.uk, phillip.lougher@gmail.com etc.) because these wil be either ignored, or you'll get a request to raise it as an issue here.
There are three reasons for this:
-
Squashfs-tools is an open project and I don't do secret discussions.
-
If multiple people email me privately about an issue, then it is impossible to prove who emailed me first, or to prove if I discovered the issue myself whilst fixing or investigating another security issue.
-
Whether due to AI or not, I am getting much more security reports than before, and I am getting multiple reports of the same issues, often within days of each other. This is often before I have had time to read them, or to respond.
This increasing level of security SPAM means it is becoming impossible to deal fairly or quickly to reports. It also drains myself as maintainer of time.
Plus whenever anything is done in secret, truth can become variable. I have absolutely no interest in going there.