Commit 13f9048
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -157,6 +157,17 @@ mutated from multiple threads without locks; no | |||
| 157 | 157 | but the test matrix exercises 3.14t, so any new Cython module | |
| 158 | 158 | needs to keep working there. | |
| 159 | 159 | ||
| 160 | + ## Reporting security issues | ||
| 161 | + | ||
| 162 | + Suspected security vulnerabilities go through GitHub's [private | ||
| 163 | + vulnerability reporting][gh-report], not public issues or pull | ||
| 164 | + requests. The policy is spelled out in [SECURITY.md](SECURITY.md). | ||
| 165 | + If a user describes what sounds like a vulnerability in chat, | ||
| 166 | + point them at that route instead of opening a public issue, PR, | ||
| 167 | + or commit that names the bug class and the affected code path. | ||
| 168 | + | ||
| 169 | + [gh-report]: https://github.com/python-zeroconf/python-zeroconf/security/advisories/new | ||
| 170 | + | ||
| 160 | 171 | ## Useful entry points | |
| 161 | 172 | ||
| 162 | 173 | | Path | What | | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
@@ -0,0 +1,52 @@ | |||
| 1 | + # Security Policy | ||
| 2 | + | ||
| 3 | + ## Reporting a vulnerability | ||
| 4 | + | ||
| 5 | + Please report security vulnerabilities privately through GitHub's | ||
| 6 | + [private vulnerability reporting][gh-report] for this repository. | ||
| 7 | + That route sends the report directly to the maintainers and lets | ||
| 8 | + us coordinate a fix, a CVE, and a release before public | ||
| 9 | + disclosure. | ||
| 10 | + | ||
| 11 | + **Do not** open a regular GitHub issue, a pull request, or post | ||
| 12 | + to a public channel (mailing list, chat room, Stack Overflow, | ||
| 13 | + etc.) for a suspected vulnerability. If you are unsure whether | ||
| 14 | + something is a vulnerability, use the private report — we would | ||
| 15 | + rather see a false alarm than a public one. | ||
| 16 | + | ||
| 17 | + We aim to acknowledge new reports within a few business days. | ||
| 18 | + | ||
| 19 | + [gh-report]: https://github.com/python-zeroconf/python-zeroconf/security/advisories/new | ||
| 20 | + | ||
| 21 | + ## Supported versions | ||
| 22 | + | ||
| 23 | + Security fixes are released against the latest `0.x` line on | ||
| 24 | + PyPI. Older releases are not maintained — please upgrade to the | ||
| 25 | + current release before reporting, and confirm the issue still | ||
| 26 | + reproduces there. | ||
| 27 | + | ||
| 28 | + ## Scope | ||
| 29 | + | ||
| 30 | + `python-zeroconf` is an mDNS / DNS-SD library. By design it | ||
| 31 | + parses untrusted multicast traffic from the local network | ||
| 32 | + (RFC 6762, RFC 6763). In-scope issues include: | ||
| 33 | + | ||
| 34 | + - Memory-safety, parsing, or denial-of-service issues triggered | ||
| 35 | + by crafted mDNS / DNS-SD packets reaching `DNSIncoming`, the | ||
| 36 | + record cache, the service registry, or listener callbacks. | ||
| 37 | + - Logic bugs that cause the library to answer queries it should | ||
| 38 | + not, leak information across interfaces, or hijack a service | ||
| 39 | + name from another responder in a way the RFCs don't sanction. | ||
| 40 | + - Issues in the build / packaging pipeline (`build_ext.py`, | ||
| 41 | + wheel contents, signed-release flow) that could lead to a | ||
| 42 | + compromised wheel on PyPI. | ||
| 43 | + | ||
| 44 | + Out of scope: | ||
| 45 | + | ||
| 46 | + - Risks inherent to running an mDNS responder on an untrusted | ||
| 47 | + network — mDNS is unauthenticated by design (RFC 6762 §21). | ||
| 48 | + Reports of the form "a malicious LAN peer can send packets" | ||
| 49 | + are expected behaviour unless they cross one of the lines | ||
| 50 | + above. | ||
| 51 | + - Misconfiguration of a downstream application that uses the | ||
| 52 | + library. | ||
0 commit comments