• darkcalling
    link
    fedilink
    English
    arrow-up
    11
    ·
    edit-2
    1 year ago

    It’s being actively exploited in the wild as we speak.

    Private disclosure is only useful and necessary when vulnerabilities are not being actively exploited or if they are exceptionally technically difficult requiring very specific conditions and you are disclosing specifically those conditions which might enable additional exploitation before a fix.

    However, this is a technically simple exploit, disclosing it exists will not enable more attackers.

    It is responsible in situations where something is being actively exploited, it is a simple exploit, etc to discuss, inform, and yes let others who may want to patch themselves have the knowledge needed to patch when devs are asleep or otherwise unable to act expediently.