No notice about serious CVE

[tomchiverton]

https://flatpak.org/blog-posts/ doesn't mention recent 10.0 CVE https://nvd.nist.gov/vuln/detail/CVE-2024-42472 ( see GHSA-7hgv-f2j8-xw87 )

Neither has a press release been added to https://flatpak.org/press/

[razzeee]

I don't think that would fit very well into blog posts or press - it also seems to only have gotten a cve from github and doesn't seem checked by other databases, which makes me wonder about the level

[tomchiverton]

So what is the project's policy on publishing vulnerabilities so users / downstream can make informed choices ? Where do they get collected and published ? Do they get collected and published ?

[razzeee]

I think https://github.com/flatpak/flatpak/blob/main/SECURITY.md#Security-Announcements is