Changes between Version 5 and Version 6 of SecurityVulnerabilityProcess

Timestamp:

Dec 19, 2009, 5:24:46 PM (14 years ago)

Author:

MarkDoliner

Comment:

--

SecurityVulnerabilityProcess

@@ -1 +1 @@
 = How to Report a Security Vulnerability =
-If you think you've found a bug in Pidgin, Finch or libpurple that could potentially be exploited in a way that could harm users or prevent them from using the program (e.g. a remotely triggerable crash), please do not disclose the information publicly!  Please do not tell people on the Pidgin devel mailing list, in the Pidgin IRC channel, or in the Pidgin Jabber conference room.
+If you think you've found a bug in our software that could be exploited in a way that could harm users or prevent them from using the software (e.g. a remotely triggerable crash):
+ * DO NOT disclose the information publicly
+ * DO NOT tell people on our mailing lists
+ * DO NOT tell people in our IRC channel or our Jabber conference room
+ * DO send an email to security@pidgin.im.  Emails to this address are sent to a core group of developers who will review the problem and take appropriate action.
 
-Instead, send an email to security@pidgin.im.  Emails to this address are sent to a core group of developers who will review the problem and take appropriate action.
+When reporting a problem to security@pidgin.im, please provide this information:
+ * The version of Pidgin, libpurple, finch, or other package in which the problem was discovered.
+ * A concise description of the problem, including a summary of why you believe it is security-critical.  This might be, for example, "Receipt of an invalid XMPP message containing the tag <foo> causes Pidgin to write data to an invalid memory location."
+ * Steps to reproduce the problem, if known.
+ * Any debugging information, including backtraces (see [wiki:GetABacktrace our instructions for obtaining a backtrace]), a debug log (the output of pidgin -d), etc.
+ * Any proof of concept exploits, debugging tools, or other information you have and are willing to divulge.
+ * The oldest and newest versions of our software affected by the bug to the best of your knowledge.  If you don't know, that's fine — we'll try to find out.
+ * Information on any security reports or vulnerability assessments you may have already made on the issue (preferably not yet public, as mentioned above).
+ * Any proposed embargo dates, release schedules, etc. you or your organization may have established.
+
 
 = Process for Developers =
- 1. Acknowledge receipt of the bug.
-   a. When a bug is reported to the security@pidgin.im mailing list, reply to the reporter with an email based on this template:
+When a developer is made aware of a security vulnerability, follow these steps:
+ 1. Acknowledge receipt the bug report.
+   a. If the bug is reported only to security@pidgin.im, reply to the reporter with an email based on this template:
 {{{
- Thank you for reporting this problem to us!
- We will investigate it and make an appropriate fix.
- In the mean time, we ask that you please not disclose the problem to the public, yet!
- Please provide us with the following information: TODO
+Thank you for reporting this problem to us!
+
+We take security problems very seriously.  We will verify that this
+is indeed a problem and release an appropriate fix as soon as
+possible.  In the mean time, please do not disclose the problem to
+the public!  We prefer to work work with distributors of our
+software to allow them to build a fixed package before the problem
+is announced publicly.
+
+Please provide us with the following information:
+[any items from the above list that were missing from the original email]
 }}}
-   a. If the bug has already been announced publicly (on devel mailing list, IRC, or Jabber conference), send all information about the bug to security@pidgin.im
- 1. Developers on the security email list should determine an appropriate fix and create a patch.
- 1. Once an agreed upon patch has been created, an email based on this template should be sent to the packagers mailing list:
+   b. If the bug has already been announced publicly (on devel mailing list, IRC, or Jabber conference), send all information about the bug to security@pidgin.im
+ 2. Developers on the security email list should determine an appropriate fix and create a patch.
+ 2. Once an agreed upon patch has been created, an email based on this template should be sent to the packagers mailing list:
 {{{
- Subject: Security Vulnerability
- Body: A security vulnerability has been discovered in [Pidgin|Finch|libpurple|other]
- Affected software: [e.x. "Pidgin 2.4.2-2.6.0", or "All clients based on libpurple 2.3.3-2.3.7"]
- Discovered by: [Name of company or individual]
- Public: ["no" or "yes as of YYYY-MM-DD"]
- Embargo date: [Either "none" or the agreed upon date]
+A security vulnerability has been discovered in [Pidgin|Finch|libpurple|other]
+Affected software: [e.x. "Pidgin 2.4.2-2.6.0", or "All clients based on libpurple 2.3.3-2.3.7"]
+Discovered by: [Name of company or individual]
+Public: ["no" or "yes as of YYYY-MM-DD"]
+Embargo date: [Either "none" or the agreed upon date]
 }}}
- 1. Announce to the world, create new packages, update security page
+ 2. Announce to the world, create new packages, update security page