Commit ffba321
doc: add info on fixup to security release process
- add details on what to do if we have an incomplete fix
- add details on how to update a CVE if necessary
Signed-off-by: Michael Dawson <mdawson@devrus.com>
PR-URL: #44807
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: Vladimir de Turckheim <vlad2t@hotmail.com>
Reviewed-By: Chengzhong Wu <legendecas@gmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: James M Snell <jasnell@gmail.com>1 parent c59d3b7 commit ffba321
1 file changed
Lines changed: 21 additions & 0 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -196,6 +196,27 @@ out a better way, forward the email you receive to | |||
| 196 | 196 | [Security release stewards](https://github.com/nodejs/node/blob/HEAD/doc/contributing/security-release-process.md#security-release-stewards). | |
| 197 | 197 | If necessary add the next rotation of the steward rotation. | |
| 198 | 198 | ||
| 199 | + ## When things go wrong | ||
| 200 | + | ||
| 201 | + ### Incomplete fixes | ||
| 202 | + | ||
| 203 | + When a CVE is reported as fixed in a security release and it turns out that the | ||
| 204 | + fix was incomplete, a new CVE should be used to cover subsequent fix. This | ||
| 205 | + is best practice and avoids confusion that might occur if people believe | ||
| 206 | + they have patched the original CVE by updating their Node.js version and | ||
| 207 | + then we later change the `fixed in` value for the CVE. | ||
| 208 | + | ||
| 209 | + ### Updating CVEs | ||
| 210 | + | ||
| 211 | + The steps to correct CVE information are: | ||
| 212 | + | ||
| 213 | + * Go to the “CVE IDs” section in your program | ||
| 214 | + sections (<https://hackerone.com/nodejs/cve_requests>) | ||
| 215 | + * Click the “Request a CVE ID” button | ||
| 216 | + * Enter the CVE ID that needs to be updated | ||
| 217 | + * Include all the details that need updating within the form | ||
| 218 | + * Submit the request | ||
| 219 | + | ||
| 199 | 220 | [H1 CVE requests]: https://hackerone.com/nodejs/cve_requests | |
| 200 | 221 | [docker-node]: https://github.com/nodejs/docker-node/issues | |
| 201 | 222 | [email]: https://groups.google.com/forum/#!forum/nodejs-sec | |
0 commit comments