Hi Robin, > any updates on this issue?
The disclosure policy [1] is to just post the details, including any possible patches to resolve the issue, to the mailing list and copy the maintainers. Please follow the policy. Peter [1] https://docs.u-boot-project.org/en/latest/develop/security.html > Kind regards, > Robin > > > -------- Forwarded Message -------- > Subject: Fwd: SySS Responsible Disclosure Policy > Date: Fri, 12 Jun 2026 22:47:14 +0200 > From: Robin Trost <[email protected]> > To: Tom Rini <[email protected]> > CC: [email protected] > > Hi Tom, > > for the advisory (SYSS-2026-039: Arbitrary OOB Heap Write / Integer > Underflow during RSA Public Key Parsing) only you showed up as a > maintainer ("THE REST"). Therefore I've resend you the advisory. > > As my last mail was already flaged by your mail provider, I've included > only the advisory (including a PoC and a "optional" fix). If necessary, > I can provide you a reproducer script, which illustrates arbitrary code > execution in the sandbox (including a python script which can be used to > build a malicious RSA public key). > > If you have furhter questions, just let me know. > > Kind regards, > Robin > > > -------- Forwarded Message -------- > Subject: SySS Responsible Disclosure Policy > Date: Wed, 10 Jun 2026 15:46:26 +0200 > From: Robin Trost <[email protected]> > To: [email protected] <[email protected]> > CC: [email protected] <[email protected]>, p_mailqueue_disclosure > <[email protected]> > > Hi all, > > The SySS GmbH deals with security issues in a responsible way. In the > form of a security advisory we report security vulnerabilities which are > not in products of our customers and which are not excluded from public > disclosure due to contractual agreements with vendors. > > The attached security advisories contain detailed information about the > found vulnerabilities that allows the vendor to reproduce and further > investigate the reported security issue. Vulnerabilities will be > disclosed to the public if a solution was published by the vendor or 45 > days after the initial report by the SySS GmbH, regardless of the > vulnerability status, for example if there is a patch or workaround from > the affected vendor. In well-founded exceptional cases, this standard > procedure may not be followed and an alternative, adjusted publication > schedule will be negotiated with the vendor. > > The goal of our Responsible Disclosure Policy is, to weigh up the need > of the public to know of security vulnerabilities against the vendor’s > time to remedy all security issues effectively. The final publication > schedule will be based on the best interests of the community overall, > considering both positions. Before the responsible disclosure of a > security vulnerability, the SySS GmbH allows vendors the opportunity to > analyze reported security issues, to develop effective countermeasures, > and to test them thoroughly. > > If there are any further questions regarding the identified > vulnerabilities do not hesitate to contact me. > > Kind regards, > -- > Robin Trost > Senior IT-Security Consultant > ______________________________________________________________ > > SySS GmbH > Schaffhausenstraße 77, 72072 Tübingen, Germany > Tel: +49 (0)7071 - 40 78 56-6169 > Mobil: +49 (0)151 - 42209330 > E-Mail: [email protected] > Conf. Calls: https://syss.zoom.us/my/robin.trost > Web: https://syss.de > > PGP-Fingerprint: 85FE 80E2 04F3 6177 C61A 4618 61DE F14F 698E 6EB3 > > Geschäftsführer: Sebastian Schreiber > Registergericht: Amtsgericht Stuttgart / HRB 382420 > Steuernummer: 86118 / 55809
