Changes between Version 2 and Version 3 of SecurityVulnerabilityProcess

Timestamp:

Sep 16, 2009, 7:17:53 PM (14 years ago)

Author:

MarkDoliner

Comment:

Incremental changes

SecurityVulnerabilityProcess

@@ -6 +6 @@
 = Process =
  1a. If the bug is reported to the security@pidgin.im mailing list, reply to the reporter with an email based on this template:
-  Thank you for reporting this problem to us!  We will investigate it and make an appropriate fix.  In the mean time, we ask that you please not disclose the problem to the public, yet!  
+  Thank you for reporting this problem to us!  We will investigate it and make an appropriate fix.  In the mean time, we ask that you please not disclose the problem to the public, yet!  Please provide us with the following information: TODO
  1b. If the bug has already been announced publicly (on devel mailing list, IRC, or Jabber conference), send all information about the bug to security@pidgin.im
  2. The developers on the security email alias should determine an appropriate fix and create a patch.
- 3. Once an agreed upon patch has been created, an email should be sent to the packagers mailing list.
+ 3. Once an agreed upon patch has been created, an email based on this template should be sent to the packagers mailing list:
+  Subject: Security Vulnerability
+  Body: A security vulnerability has been discovered in [Pidgin|Finch|libpurple|other]
+  Affected software: [e.x. "Pidgin 2.4.2-2.6.0", or "All clients based on libpurple 2.3.3-2.3.7"]
+  Discovered by: [Name of company or individual]
+  Public: [yes or no]
+  Embargo date: [Either "none" or the agreed upon date]
+4. Announce to the world, create new packages, update security page