russell@unturf.com
0a580b313d
Authors: russell@unturf.com · brackishbert@gmail.com · foxhop.net · TimeHexOn.com Patches, unit tests, benchmarks, whitepaper, and outreach briefs. Public domain — no copyright claimed. Use freely.
55 lines
1.6 KiB
Markdown
55 lines
1.6 KiB
Markdown
# Email Draft — CWE-407 Pre-Disclosure Outreach
|
|
|
|
**To:** [maintainer security contact — see README.md for sequencing]
|
|
**From:** security@undefect.com
|
|
**Subject:** Pre-disclosure: CWE-407 in [TOOL] — coordinated disclosure request
|
|
**Attachment:** [tool].pdf (also in outreach.tar.gz · MD5: see MD5SUMS)
|
|
|
|
---
|
|
|
|
Hello [maintainer name],
|
|
|
|
We have identified a confirmed CWE-407 (Inefficient Algorithmic Complexity) defect in
|
|
**[TOOL]**. We have a patch, a complexity proof, and a benchmark. We are requesting a
|
|
**90-day coordinated disclosure window** before any public release.
|
|
|
|
**The short version:**
|
|
|
|
A list is used where a set belongs, inside a [graph traversal / query planning / dependency
|
|
resolution] loop. Membership is tested by linear scan. The result is O(n²) behavior in
|
|
code that should run in O(n). The fix is a one-line data structure substitution with no
|
|
behavioral change.
|
|
|
|
The attached brief covers:
|
|
|
|
- The exact file and line
|
|
- Before/after code
|
|
- Complexity proof (O-notation)
|
|
- Benchmark numbers
|
|
- The patch
|
|
|
|
**What we ask:**
|
|
|
|
1. Confirm receipt within 5 business days.
|
|
2. Validate the patch against your CI / regression suite.
|
|
3. Coordinate a release date within the 90-day window.
|
|
4. Credit optional — the goal is the fix, not the credit.
|
|
|
|
We are disclosing to all affected maintainers on a sequenced schedule. Your disclosure
|
|
window starts from the date of this email.
|
|
|
|
Reply to this address or open a security advisory at your discretion.
|
|
|
|
— undefect.
|
|
security@undefect.com
|
|
https://undefect.com
|
|
|
|
---
|
|
|
|
**Attachment integrity:**
|
|
|
|
```
|
|
[PASTE MD5 FROM outreach/MD5SUMS for the specific PDF]
|
|
```
|
|
|
|
Verify with: `md5sum [tool].pdf`
|