Boost.Graph security issues

From: Jeremy Murphy (jeremy.william.murphy_at_[hidden])
Date: 2024-04-13 06:58:58

Dear Boost community,

I've recently received a few security issue notifications from both the
Google Chrome fuzzer project and Shielder (part of an OSTIF project), and
basically I'm not sure how much to worry about them. I don't have time to
fix them (but I can review and merge fixes), and I don't know how to draw
attention to the need to fix them without publicizing the issues (which are
still not published). It all depends on how many people actually are
exposed via Boost.Graph and to what severity, right? I have no idea, but my
gut tells me not many, as most Boost.Graph users I hear about are just
using it internally, not exposing the interfaces to input from the
Internet. But I'm not a security expert, that's why I'm asking you. What
should I do?

Thanks, cheers.

Jeremy