ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
oss-securitypublished ()ingested
Part of a story covered by 3 sources: “rosbridge_library Protocol.incoming() quadratic CPU cost disclosed on oss-security; follow-ups flag uncoordinated disclosure” — merged summary and timeline →

Re: rosbridge_library Protocol.incoming() quadratic CPU cost in JSON fallback

lowVulnerabilityimportance 12
AI summary · glm-5.3

David Wheeler notes a rosbridge_library quadratic CPU cost flaw was publicly disclosed on oss-security without prior coordination.

In an oss-security reply, David A. Wheeler pointed out that a poster had just publicly disclosed details of a quadratic CPU cost issue in rosbridge_library's Protocol.incoming() JSON fallback path. Wheeler referenced the mailing list's stated norms encouraging public discussion of open-source security flaws. The reply itself contains no fix, CVE, or exploitation details.

  • rosbridge_library Protocol.incoming() JSON fallback has quadratic CPU cost
  • Issue was disclosed publicly on oss-security without coordination
Read the original
Tagsrosbridgerosdenial-of-servicedisclosureoss-security
Full article

Posted by David A. Wheeler on Sep 14 Hi, you just disclosed that information publicly. As clearly explained https://oss-security.openwall.org/wiki/mailing-lists/oss-security >: "The purpose of the Open Source Security (oss-security) group is to encourage public discussion of security flaws, concepts, and practices in the Open Source community... A read-only archive of the discussions contained on the list is available to...

This source does not provide full text. Read it at seclists.org.