upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-03-18 16:43:27 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
bind9/.gitlab/issue_templates/CVE.md
Michał Kępień fe503854f0
Remove steps related to the post-mortem meeting 
The post-mortem meeting is now considered an on-demand event.  The past
few security release cycles proved that there is rarely a need to
discuss things in this form, so there is little point in carrying out
the relevant steps for every single vulnerability - which does not
prevent us from doing so if the actual need arises.
2023-11-16 11:39:51 +01:00

14 KiB
Raw Blame History

Quick Links 🔗
Incident Manager: @user
Deputy Incident Manager: @user
Public Disclosure Date: YYYY-MM-DD
CVSS Score: 0.0
Security Advisory: isc-private/printing-press!NNN
Mattermost Channel: [CVE-YYYY-NNNN][mattermost_url]
Support Ticket: [URL]
Release Checklist: #NNNN

[mattermost_url]:

💡 Click here (internal resource) for general information about the security incident handling process.

Earlier Than T-5

  • 🔗 (IM) Pick a Deputy Incident Manager
  • 🔗 (IM) Respond to the bug reporter
  • 🔗 (SwEng) Ensure there are no public merge requests which inadvertently disclose the issue
  • 🔗 (IM) Assign a CVE identifier
  • 🔗 (SwEng) Update this issue with the assigned CVE identifier and the CVSS score
  • 🔗 (SwEng) Determine the range of product versions affected (including the Subscription Edition)
  • 🔗 (SwEng) Determine whether workarounds for the problem exist
  • 🔗 (SwEng) If necessary, coordinate with other parties
  • 🔗 (Support) Prepare "earliest" notification text and hand it off to Marketing
  • 🔗 (Marketing) Update "earliest" notification document in SF portal and send bulk email to earliest customers
  • 🔗 (Support) Create a merge request for the Security Advisory and include all readily available information in it
  • 🔗 (SwEng) Prepare a private merge request containing a system test reproducing the problem
  • 🔗 (SwEng) Notify Support when a reproducer is ready
  • 🔗 (SwEng) Prepare a detailed explanation of the code flow triggering the problem
  • 🔗 (SwEng) Prepare a private merge request with the fix
  • 🔗 (SwEng) Ensure the merge request with the fix is reviewed and has no outstanding discussions
  • 🔗 (Support) Review the documentation changes introduced by the merge request with the fix
  • 🔗 (SwEng) Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
  • 🔗 (Support) Finish preparing the Security Advisory
  • 🔗 (QA) Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
  • 🔗 (QA) (BIND 9 only) Reserve a block of CHANGES placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
  • 🔗 (QA) Merge the CVE fixes in CVE identifier order
  • 🔗 (QA) Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
  • 🔗 (QA) Prepare ASN releases (as outlined in the Release Checklist)

At T-5

  • 🔗 (Marketing) Update the text on the T-5 (from the Printing Press project) and "earliest" ASN documents in the SF portal
  • 🔗 (Marketing) (BIND 9 only) Update the BIND -S information document in SF with download links to the new versions
  • 🔗 (Marketing) Bulk email eligible customers to check the SF portal
  • 🔗 (Marketing) (BIND 9 only) Send a pre-announcement email to the bind-announce mailing list to alert users that the upcoming release will include security fixes

At T-1

  • 🔗 (First IM) Send notifications to OS packagers

On the Day of Public Disclosure

  • 🔗 (IM) Grant QA & Marketing clearance to proceed with public release
  • 🔗 (QA/Marketing) Publish the releases (as outlined in the release checklist)
  • 🔗 (Support) (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
  • 🔗 (Support) Bump Document Version for the Security Advisory and publish it in the Knowledge Base
  • 🔗 (First IM) Send notification emails to third parties
  • 🔗 (First IM) Advise MITRE about the disclosed CVEs
  • 🔗 (First IM) Merge the Security Advisory merge request
  • 🔗 (IM) Inform original reporter (if external) that the security disclosure process is complete
  • 🔗 (Marketing) Update the SF portal to clear the ASN
  • 🔗 (Marketing) Email ASN recipients that the embargo is lifted

After Public Disclosure

  • 🔗 (QA) Merge a regression test reproducing the bug into all affected (and still maintained) branches