Request to Fix the Security Issue reported [Private]

[febinrev]

Hi,

This is Febin Mon Saji, an independent Security researcher. I reported a root privilege escalation via race-condition vulnerability (for linux) couple of months back, via [email protected] and acknowledged by Balena team and even got a Swag pack. I hope you the developers are aware of the vulnerability and are already working on the patch and hope the newer version will be released soon.

As the vendor confirmed the issue and working on the patch, I wish to apply for a CVE id for the said vulnerability.

Let me know your thoughts.

Thanks.

[aethernet]

As expressed privately (adding it here for transparency), we're in the middle of a quite deep revamp to address this and other issues.

Thanks for being patient, we take this seriously.

[febinrev]

I hope the issue is fixed in the new pre-release version v1.18.13.