{"id":137993,"date":"2025-06-22T11:11:54","date_gmt":"2025-06-22T09:11:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/soprovozhdayushhij-libxml2-otkazalsya-ot-osobogo-otnosheniya-k-ustraneniyu-uyazvimostej"},"modified":"2025-06-22T11:11:54","modified_gmt":"2025-06-22T09:11:54","slug":"soprovozhdayushhij-libxml2-otkazalsya-ot-osobogo-otnosheniya-k-ustraneniyu-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/soprovozhdayushhij-libxml2-otkazalsya-ot-osobogo-otnosheniya-k-ustraneniyu-uyazvimostej","title":{"rendered":"A libxml2 k\u00eds\u00e9r\u0151je lemondott a sebezhet\u0151s\u00e9gek kezel\u00e9s\u00e9re vonatkoz\u00f3 k\u00fcl\u00f6nleges hozz\u00e1\u00e1ll\u00e1sr\u00f3l.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Nick Wellnhofer, a maintainer of the libxml2 library, has announced that vulnerabilities will henceforth be treated as ordinary bugs. Vulnerability reports will not be prioritized but will be addressed as time permits. Information about the nature of vulnerabilities will be made publicly available immediately, without waiting for a patch to be formed and distributed in distributions and operating systems. Nick has also relinquished his role as the maintainer of the libxslt library and expressed doubts that anyone would be willing to take on its support. <\/p>\n
A note has been added to the description of the libxml2 project, indicating that the library is written by enthusiasts, maintained by a single volunteer, poorly tested, written in an unsafe memory language, contains numerous vulnerabilities, and is not recommended for processing untrusted data. Security issue reports are to be sent through the established public bug tracking system and will be handled like any other bugs. Vulnerabilities will no longer be fixed behind closed doors, and all information regarding security issues will be published immediately, regardless of non-disclosure requirements until a specified date and without delaying disclosure until the release. <\/p>\n
It is expected that the shift to handling vulnerabilities as ordinary bugs will allow Nick to focus on the main work on libxml2 without being interrupted by unplanned tasks. Currently, Nick spends several hours a week handling vulnerability reports and preparing patches, which creates a significant burden considering that the maintenance is carried out solely out of enthusiasm. <\/p>\n
It is noted that hiding information about vulnerabilities until updates are published and metrics like OpenSSF Scorecard is merely an attempt by large companies to induce feelings of guilt among maintainers and force them to work for free. Imposing additional requirements on volunteer maintainers who work without compensation has been called a detrimental practice. <\/p>\n
Nick szerint a libxml2 k\u00f6nyvt\u00e1r min\u0151s\u00e9ge nem elegend\u0151 ahhoz, hogy b\u00f6ng\u00e9sz\u0151kben \u00e9s oper\u00e1ci\u00f3s rendszerekben haszn\u00e1lj\u00e1k. Ennek ellen\u00e9re olyan nagyv\u00e1llalatok, mint az Apple, a Google \u00e9s a Microsoft, elkezdt\u00e9k a libxml2 haszn\u00e1lat\u00e1t saj\u00e1t oper\u00e1ci\u00f3s rendszereikben \u00e9s term\u00e9keikben. Az ilyen l\u00e9p\u00e9seket felel\u0151tlennek tartj\u00e1k, \u00e9s a v\u00e9grehajtott munka pr\u00f3b\u00e1lkoz\u00e1soknak min\u0151s\u00fcl, amelyek a t\u00fcnetek elt\u00e1vol\u00edt\u00e1s\u00e1ra f\u00f3kusz\u00e1lnak, nem pedig a probl\u00e9m\u00e1k ok\u00e1nak megsz\u00fcntet\u00e9s\u00e9re. Nick szerint a projekt sz\u00e1m\u00e1ra jobb lenne, ha a megeml\u00edtett c\u00e9gek le\u00e1ll\u00edtan\u00e1k a libxml2 haszn\u00e1lat\u00e1t. \n Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"