Hello, I am coordinating a vulnerability disclosure for an issue confirmed in a macOS fork/package of SPICE vdagent.
I have already contacted the UTM/Turing Software maintainer privately, since the confirmed affected macOS package is shipped with UTM guest tools and is signed by Turing Software. The maintainer of the macOS fork advised me to contact upstream as well because the project is forked from: https://gitlab.freedesktop.org/spice/linux/vd_agent I have not confirmed that Linux builds are affected, so I do not want to disclose technical details on the public mailing list. Could a maintainer please point me to the preferred private security contact for SPICE/vdagent, or confirm whether I should send the report through Red Hat Product Security? Regards, forrof
