Re: [PATCH 3/5] gdb: extend SECURITY.txt discussion of DWARF/BFD parser bugs

[Siddhesh Poyarekar <sipoyare@redhat.com>]

On 10/12/26 9:49 AM, Andrew Burgess wrote:
>    3. The real change: clearly state that bugs in the DWARF/BFD parser
>       can be security bugs, but they are unlikely to be considered high
>       priority, and users should instead use sandboxing to provide
>       protection.  The text about bugs from well-formed programs is
>       retained.
I don't have a strong opinion on the meat of the change, but I want to 
point out that this is not sufficient deterrence for people flooding the 
project with such reports to get CVE creds in their name.  What priority 
a CVE gets downstream is typically a result of perception and the 
relatively dumb CVSS scores.  Unfortunately all major distributions are 
currently lost to that madness and "unlikely to be considered high 
priority" may not actually pan out that way in practice.

Sid