Vulnerability Report

[aleister1102]

Hi,

I have submitted two GitHub advisories in the "Security and quality" tab of the current repo. Maybe you wonder why I don't submit via BugCrowd. I did, but the experience is bad because one of the submissions is ignored totally, while the fix is still delivered. Proofs are in the advisories.

Please have a look at them.

Thanks!

[newrelic-php-agent-bot]

Thank you for your issue report. A member of the New Relic PHP Agent Team will review your report and endeavor to respond in a timely manner.
Need troubleshooting help? Please review some of our common troubleshooting documentation, starting with generating debug logs. From there, additional resources and tips are available in our troubleshooting section, accessible from the left-hand panel of our documentation site. Additionally, please be sure to visit our Explorer's Hub, where other members of the community may have solved an issue similar to yours with the help of our Support team members.
Have a question regarding support for an Operating System, PHP Version, Framework, or Library? Please take a look at our Compatibility Docs.
Binary support for ARM-based CPU architecture is now available via the tarball installation method for PHP Versions 8.0+!
General installation instructions can be found on our Installation Overview page.
Need more information about an Agent INI setting? Our Configuration page contains an explanation for each INI setting and how to modify the defaults.
Looking for something else? All New Relic PHP Agent Documentation can be found under our Introduction page.

[bduranleau-nr]

Hi @aleister1102,

We appreciate you reaching out and for your interest in keeping our systems secure.
We definitely value the effort it takes to hunt for vulnerabilities. However, to ensure your findings are handled by the right team, tracked properly, and eligible for any potential recognition or bounties, we require all researchers to submit their reports through our official Coordinated Vulnerability Disclosure.

Thank you,
The New Relic PHP Agent Team