mirror/curl
2
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2025-01-18 14:04:30 +08:00
Code Issues Packages Projects Releases Wiki Activity

SECURITY-PROCESS: tweak a little to match current practices

Browse Source 
Closes #7713
This commit is contained in:
Daniel Stenberg 2021-09-13 10:23:50 +02:00
parent 4a8fa48946
commit 408f61dc30
No known key found for this signature in database
GPG Key ID: 5CC908FDB71E12C2
1 changed files with 11 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
docs/SECURITY-PROCESS.md
View File

@ -62,19 +62,20 @@ announcement.
- Request a CVE number from
[HackerOne](https://docs.hackerone.com/programs/cve-requests.html)
- Consider informing
[distros@openwall](https://oss-security.openwall.org/wiki/mailing-lists/distros)
to prepare them about the upcoming public security vulnerability
announcement - attach the advisory draft for information. Note that
'distros' won't accept an embargo longer than 14 days and they do not care
for Windows-specific flaws.
- Update the "security advisory" with the CVE number.
- The security team commits the fix in a private branch. The commit message
should ideally contain the CVE number. This fix is usually also distributed
to the 'distros' mailing list to allow them to use the fix prior to the
public announcement.
should ideally contain the CVE number.
- The security team also decides on and delivers a monetary reward to the
reporter as per the bug-bounty polices.
- No more than 10 days before release, inform
[distros@openwall](https://oss-security.openwall.org/wiki/mailing-lists/distros)
to prepare them about the upcoming public security vulnerability
announcement - attach the advisory draft for information with CVE and
current patch. 'distros' does not accept an embargo longer than 14 days and
they do not care for Windows-specific flaws.
- No more than 48 hours before the release, the private branch is merged into
the master branch and pushed. Once pushed, the information is accessible to