The Apache Software Foundation takes a very active stance in eliminating security problems.
We strongly encourage folks to report such problems to the private security mailing list of the ASF Security Team, before disclosing them in a public forum.
Please see the page of the ASF Security Team for further information and contact information.