Insecure Deserialization and Memory-Based Confusion Attacks in Boost Serialization

[TrebledJ]

An issue was discovered in Boost Serialization v1.89.0 and below. Insecure deserialization of untrusted input under certain conditions may lead to type confusion and ownership confusion, -- redacted --.

-- details redacted temporarily, discussion with maintainers ongoing --

[gennaroprota]

Apologies for the long silence on this. I have recently taken over maintenance of Boost.Serialization, and would like to assess and fix it.

Until now, there was no private reporting channel for this library. I have now enabled GitHub's private vulnerability reporting, so please file the details there:

https://github.com/boostorg/serialization/security/advisories/new.

Thank you for holding the details back and for your patience.