Windl, Ulrich wrote:
Hi!
Some comments:
A crash, an abort, an assertion failure, or a hang is a **bug**, not a security issue.
So a DoS (Denial of Service) (e.g. by crashing the app from remote) is not a security issue?
It does not allow remote code execution, privilege escalation, or privileged data exfiltration. So no, it is not a security issue.
**LMDB trusts its own database files by contract.**
A long time Linux did trust filesystems as well, but some people managed to do bad things by providing manipulated filesystem images (e.g. ISOs). So if some deployment scenario would provide an LMDB image, and that image would cause some buffer overflow, resulting in execution of unwanted actions, wouldn't that be a security bug to care for?
ISO files are, by design, portable formats meant for public exchange. Thus they actually have a significant exposure, by design.
LMDB is an embedded database engine, its files are architecture-specific. It is non-portable by design. Its files are private data, owned by the applications that created them, not meant for public exchange. The security of the files is entirely the responsibility of the applications that created them.
The entire question is ludicrous - when was the last time anyone emailed a BerkeleyDB database file or made it publicly downloadable?
In general I think the guidelines are even a bit too technical for the average user.
The guidelines are aimed at security researchers, with the purpose of discouraging the filing of ordinary bug reports as security issues. Of course they must be technical.
Kind regards, Ulrich Windl
-----Original Message----- From: Howard Chu hyc@symas.com Sent: Tuesday, August 11, 2026 6:11 PM To: OpenLDAP Technical openldap-technical@OpenLDAP.org Subject: [EXT] Security policy
Since AI-driven "researchers" are submitting more bug reports these days in hopes of adding CVEs to their CVs, we're probably going to need to publish a more formalized security policy on the openldap.org web site. This is an example of what we're starting with. Feedback welcome.