4 ms·
GitHub: Widespread Injection Vulnerabilities in Actions
- mtmail 6y agoThose confused why the page says July 2020: it was hidden until today. "2020-07-21 Report sent to Github and triaged by Github security team. Disclosure date is set for 2020-10-18." [...] "2020-11-01 Github responds and mentions that they won't be disabling the vulnerable commands by 2020-11-02. They request an additional 48 hours, not to fix the issue, but to notify customers and determine a "hard date" at some point in the future. 2020-11-02 Project Zero responds that there is no option to further extend the deadline as this is day 104 (90 days + 14 day grace extension) and that the disclosure will be today."