Security private reporting - Revision history

Marta Rybczynska: Add embargoes case

2023-10-30T07:06:45Z

Add embargoes case

← Older revision		Revision as of 07:06, 30 October 2023
Line 75:		Line 75:

	When the fix is publicly available, the YP security team member or the package maintainer sends patches against the YP code base, following usual procedures, including public code review.		When the fix is publicly available, the YP security team member or the package maintainer sends patches against the YP code base, following usual procedures, including public code review.

			== Handling multi-project embargoes ==

			In rare cases, a severe security issue affects multiple projects. This might be numerous projects having a similar issue because of design, coding pattern, or reuse of the same code (an example of this situation is CVE-2023-44487 where multiple web servers share a design weakness). It might also be a high-profile issue in a commonly used library (like OpenSSL). In such cases, the project, learning first about the issue, might decide to notify other affected projects confidentially so that they come up with a synchronized fix. It might also be the affected project informing major distributions to roll out the update simultaneously.

			Such notifications happen over confidential, non-public means. Typically, the project initiating this "embargo" directly notifies a selected number of people from each project, including a subset of the security team. When Yocto Project is a part of such a notified group, developers prepare fixes on separate infrastructure and test it. They might also include additional developers and domain experts who can help with the fix and eventual regressions. When the embargo is lifted, they send a patch to the relevant public list, and the usual review process starts.

	== Current Security Team Members ==		== Current Security Team Members ==

Marta Rybczynska: Add a note on migration to docs

2023-10-30T06:48:36Z

Add a note on migration to docs

← Older revision		Revision as of 06:48, 30 October 2023
Line 1:		Line 1:
	= (WIP) Security team and private reporting =		= (WIP) Security team and private reporting =

			Note: this page is undergoing migration to [https://docs.yoctoproject.org/ the official Yocto Project documentation].

	== How to Report a Potential Vulnerability? ==		== How to Report a Potential Vulnerability? ==

Marta Rybczynska: /* Current Security Team Members */ Add Steve and his key

2023-10-20T14:32:45Z

Current Security Team Members: Add Steve and his key

← Older revision		Revision as of 14:32, 20 October 2023
Line 89:		Line 89:
	* Marta Rybczynska '''<marta DOT rybczynska [at] syslinbit [dot] com>'''		* Marta Rybczynska '''<marta DOT rybczynska [at] syslinbit [dot] com>'''
	: [https://keys.openpgp.org/search?q=marta.rybczynska@syslinbit.com Public key]		: [https://keys.openpgp.org/search?q=marta.rybczynska@syslinbit.com Public key]

			* Steve Sakoman '''<steve [at] sakoman [dot] com>'''
			: [https://keys.openpgp.org/search?q=steve%40sakoman.com Public key]

Marta Rybczynska: Fix formatting

2023-10-18T05:29:15Z

Fix formatting

← Older revision		Revision as of 05:29, 18 October 2023
Line 1:		Line 1:
	= (WIP) Security team and private reporting =		= (WIP) Security team and private reporting =

	How to Report a Potential Vulnerability?		== How to Report a Potential Vulnerability? ==
	~~======================================~~==

	If you would like to report a public issue (for example, one with a released CVE number), please report it using the [https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Security Security Bugzilla].		If you would like to report a public issue (for example, one with a released CVE number), please report it using the [https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Security Security Bugzilla].

Marta Rybczynska: How to report: Update in line to the SECURITY.md proposal v2

2023-10-18T05:28:07Z

How to report: Update in line to the SECURITY.md proposal v2

← Older revision		Revision as of 05:28, 18 October 2023
Line 1:		Line 1:
	= (WIP) Security team and private reporting =		= (WIP) Security team and private reporting =

	~~== How to Report a Vulnerability? ==~~

	~~Please~~ send a message to security ~~[at]~~ yoctoproject ~~[dot]~~ org, including as many details as possible: the layer or software module affected, the recipe and its version, and any example code, if available.		How to Report a Potential Vulnerability?
			========================================

			If you would like to report a public issue (for example, one with a released CVE number), please report it using the [https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Security Security Bugzilla].

			If you are dealing with a not-yet-released or urgent issue, please send a message to security AT yoctoproject DOT org, including as many details as possible: the layer or software module affected, the recipe and its version, and any example code, if available.

	''' Branches maintained with security fixes'''		''' Branches maintained with security fixes'''

Rpurdie at 10:23, 17 October 2023

2023-10-17T10:23:10Z

Rpurdie at 10:13, 17 October 2023

2023-10-17T10:13:04Z

← Older revision		Revision as of 10:13, 17 October 2023
Line 9:		Line 9:
	See [https://wiki.yoctoproject.org/wiki/Stable_Release_and_LTS Stable release and LTS]for detailed info regarding the policies and maintenance of Stable branch.		See [https://wiki.yoctoproject.org/wiki/Stable_Release_and_LTS Stable release and LTS]for detailed info regarding the policies and maintenance of Stable branch.

	The [https://wiki.yoctoproject.org/wiki/Releases Release page] contains a list of all releases of the Yocto Project. Versions in grey are no longer actively maintained with security patches, but well-tested patches may still be accepted for them.		The [https://wiki.yoctoproject.org/wiki/Releases Release page] contains a list of all releases of the Yocto Project. Versions in grey are no longer actively maintained with security patches, but well-tested patches may still be accepted for them for significant issues.

	== How to Contact the Yocto Project regarding Security ==		== How to Contact the Yocto Project regarding Security ==

Rpurdie at 10:12, 17 October 2023

2023-10-17T10:12:21Z

← Older revision		Revision as of 10:12, 17 October 2023
Line 3:		Line 3:
	== How to Report a Vulnerability? ==		== How to Report a Vulnerability? ==

	Please send a message to security [at] yoctoproject [dot] org, including as many details as possible: the layer or software module affected, the recipe and its version, and an example code, if available.		Please send a message to security [at] yoctoproject [dot] org, including as many details as possible: the layer or software module affected, the recipe and its version, and any example code, if available.

	''' Branches maintained with security fixes'''		''' Branches maintained with security fixes'''

Marta Rybczynska: Add Marta's public key

2023-10-17T10:00:37Z

Add Marta's public key

← Older revision		Revision as of 10:00, 17 October 2023
Line 84:		Line 84:
	* Ross Burton '''<ross@burtonini.com>'''		* Ross Burton '''<ross@burtonini.com>'''
	: [https://keys.openpgp.org/search?q=ross%40burtonini.com Public key]		: [https://keys.openpgp.org/search?q=ross%40burtonini.com Public key]

			* Marta Rybczynska '''<marta DOT rybczynska [at] syslinbit [dot] com>'''
			: [https://keys.openpgp.org/search?q=marta.rybczynska@syslinbit.com Public key]

Marta Rybczynska: Develop the part of the YP security team functioning

2023-10-17T09:48:09Z

Develop the part of the YP security team functioning

← Older revision		Revision as of 09:48, 17 October 2023
Line 59:		Line 59:

	The YP security team organizes its meetings and communication as needed.		The YP security team organizes its meetings and communication as needed.

			When the YP Security team receives a report about a potential security vulnerability, they quickly analyze and notify the reporter of the result. They might also request more information.

			If the issue is confirmed and affects the code maintained by the YP, they confidentially notify maintainers of that code and work with them to prepare a fix.

			If the issue is confirmed and affects an upstream project, the YP security team notifies the project. Usually, the upstream project analyzes the problem again. If they deem it a real security problem in their software, they develop and release a fix following their security policy. They may want to include the original reporter in the loop. There is also sometimes some coordination for handling patches, backporting patches etc, or just understanding the problem or what caused it.

			The security policy of the upstream project might include a notification to Linux distributions or other important downstream projects in advance to discuss coordinated disclosure. These mailing lists are generally non-public. The YP Security Team participates in the discussion as needed. They might also include the YP maintainer of the affected package.

			When the upstream project releases a version with the fix, they are responsible for contacting Mitre (cve.mitre.org) to get a CVE number assigned and the CVE record published.

			When the fix is publicly available, the YP security team member or the package maintainer sends patches against the YP code base, following usual procedures, including public code review.

	== Current Security Team Members ==		== Current Security Team Members ==

← Older revision		Revision as of 10:23, 17 October 2023
Line 26:		Line 26:
	'''What you should do if you find a security vulnerability'''		'''What you should do if you find a security vulnerability'''
	---------------------------------------------		---------------------------------------------
	If you find a security flaw; a crash, an information leakage, or anything that can have a security impact if exploited in any Open Source ~~packages~~ used by the Yocto Project, please report this to the Yocto Project Security Team. If you prefer to contact the upstream project directly, please send a copy to the security team at Yocto as well.		If you find a security flaw; a crash, an information leakage, or anything that can have a security impact if exploited in any Open Source software built or used by the Yocto Project, please report this to the Yocto Project Security Team. If you prefer to contact the upstream project directly, please send a copy to the security team at the Yocto Project as well.
	If you believe this is highly sensitive information, please report the vulnerability in a secure way, i.e. encrypt the email and send it to the private list. This ensures that the exploit is not leaked and exploited before a response/fix has been generated.		If you believe this is highly sensitive information, please report the vulnerability in a secure way, i.e. encrypt the email and send it to the private list. This ensures that the exploit is not leaked and exploited before a response/fix has been generated.

Line 32:		Line 32:
	'''What Yocto Security Team does when it receives a security vulnerability'''		'''What Yocto Security Team does when it receives a security vulnerability'''
	---------------------------------------------		---------------------------------------------
	The YP Security Team team performs a quick analysis and ~~reports~~ the flaw to the upstream project. Normally the upstream project analyzes the problem. If they deem it a real security problem in their software, they develop and release a fix following their own security policy. They may want to include the original reporter in the loop. There is also sometimes some coordination for handling patches, backporting patches etc, or just understanding the problem or what caused it.		The YP Security Team team performs a quick analysis and would usually report the flaw to the upstream project. Normally the upstream project analyzes the problem. If they deem it a real security problem in their software, they develop and release a fix following their own security policy. They may want to include the original reporter in the loop. There is also sometimes some coordination for handling patches, backporting patches etc, or just understanding the problem or what caused it.

	The security policy of the upstream project might include a notification to Linux distributions or other important downstream projects in advance to discuss coordinated disclosure. These mailing lists are normally non-public.		The security policy of the upstream project might include a notification to Linux distributions or other important downstream projects in advance to discuss coordinated disclosure. These mailing lists are normally non-public.
Line 48:		Line 48:
	== Security Team Appointment ==		== Security Team Appointment ==

	The Yocto Project Security Team consists of at least three members. When new members are needed, the YP TSC asks for nominations by public channels, including ~~also the limit date~~. Self-nominations are possible. When the limit time is reached, the YP TSC posts the list of candidates for the comments of project participants and developers. Comments may be sent publicly or privately to the YP and OE TSCs. The candidates are approved by both YP TSC and OE TSC and the final list of the team members is announced publicly.		The Yocto Project Security Team consists of at least three members. When new members are needed, the YP TSC asks for nominations by public channels including a nomination deadline. Self-nominations are possible. When the limit time is reached, the YP TSC posts the list of candidates for the comments of project participants and developers. Comments may be sent publicly or privately to the YP and OE TSCs. The candidates are approved by both YP TSC and OE TSC and the final list of the team members is announced publicly. The aim is to have people representing technical leadership, security knowledge and infrastructure present with enough people to provide backup/coverage but keep the notification list small enough to minimise information risk and maintain trust.

	YP Security Team members may resign at any time.		YP Security Team members may resign at any time.