Changes between Version 1 and Version 2 of SecurityVulnerabilityProcess

Timestamp:

Sep 16, 2009, 7:00:32 PM (14 years ago)

Author:

MarkDoliner

Comment:

Incrementatl changes

SecurityVulnerabilityProcess

@@ -1 +1 @@
 = How to Report a Security Vulnerability =
-If you think you've found a bug in Pidgin, Finch or libpurple that could potentially be exploited in a way that could harm users or prevent them from using the program (e.g. a remotely triggerable crash), please do not disclose the information publicly!  Please do not tell people on the Pidgin devel mailing list or in the Pidgin IRC channel or in the Pidgin Jabber conference room.
+If you think you've found a bug in Pidgin, Finch or libpurple that could potentially be exploited in a way that could harm users or prevent them from using the program (e.g. a remotely triggerable crash), please do not disclose the information publicly!  Please do not tell people on the Pidgin devel mailing list, in the Pidgin IRC channel, or in the Pidgin Jabber conference room.
 
 Instead, send an email to security@pidgin.im.  Emails to this alias are sent to a core group of developers who will review the problem and take appropriate action.
 
 = Process =
- 1. TODO
+ 1a. If the bug is reported to the security@pidgin.im mailing list, reply to the reporter with an email based on this template:
+  Thank you for reporting this problem to us!  We will investigate it and make an appropriate fix.  In the mean time, we ask that you please not disclose the problem to the public, yet!  
+ 1b. If the bug has already been announced publicly (on devel mailing list, IRC, or Jabber conference), send all information about the bug to security@pidgin.im
+ 2. The developers on the security email alias should determine an appropriate fix and create a patch.
+ 3. Once an agreed upon patch has been created, an email should be sent to the packagers mailing list.