Potential Vulnerability in Z-Push

[SNK18650-KN]

Hello, I’m Lion from the Snyk Security team.
We track, triage, and verify issues and vulnerabilities in open source dependencies and work with maintainers to make open source secure. More information regarding our tracked vulnerabilities can be found here: https://security.snyk.io/vuln/

We suspect a potential vulnerability within the project and would appreciate guidance on the appropriate channel for reporting it.
The Security section of the project in GitHub mentioned we should report it in the discussions here; however, we wanted to confirm this in case you might want to assess the report in advance before mentioning it publicly here.

[matidau]

Hi Lion,

I've invited @SNK18650-KN to this private repo https://github.com/Z-Push/SNK18650-KN/issues

If you can post the details there it would be appreciated.

Cheers,
Mat

[grammmichi]

Hi Lion!
Grommunio uses a fork of Z-Push as activesync implementation. Many things were changed, but many core components are similar to Z-push.
https://github.com/grommunio/grommunio-sync

If @matidau agrees, I would like to participate in this analysis.

[matidau]

I welcome the collaboration, and invited you to the repo.