1c-ares security
2===============
3
4This document is intended to provide guidance on how security vulnerabilities
5should be handled in the c-ares project.
6
7Publishing Information
8----------------------
9
10All known and public c-ares vulnerabilities will be listed on [the c-ares web
11site](https://c-ares.haxx.se/vulns.html).
12
13Security vulnerabilities should not be entered in the project's public bug
14tracker unless the necessary configuration is in place to limit access to the
15issue to only the reporter and the project's security team.
16
17Vulnerability Handling
18----------------------
19
20The typical process for handling a new security vulnerability is as follows.
21
22No information should be made public about a vulnerability until it is
23formally announced at the end of this process. That means, for example that a
24bug tracker entry must NOT be created to track the issue since that will make
25the issue public and it should not be discussed on the project's public
26mailing list. Also messages associated with any commits should not make any
27reference to the security nature of the commit if done prior to the public
28announcement.
29
30- The person discovering the issue, the reporter, reports the vulnerability
31  privately to `c-ares-security@haxx.se`. That's an email alias that reaches a
32  handful of selected and trusted people.
33
34- Messages that do not relate to the reporting or managing of an undisclosed
35  security vulnerability in c-ares are ignored and no further action is
36  required.
37
38- A person in the security team sends an e-mail to the original reporter to
39  acknowledge the report.
40
41- The security team investigates the report and either rejects it or accepts
42  it.
43
44- If the report is rejected, the team writes to the reporter to explain why.
45
46- If the report is accepted, the team writes to the reporter to let him/her
47  know it is accepted and that they are working on a fix.
48
49- The security team discusses the problem, works out a fix, considers the
50  impact of the problem and suggests a release schedule. This discussion
51  should involve the reporter as much as possible.
52
53- The release of the information should be "as soon as possible" and is most
54  often synced with an upcoming release that contains the fix. If the
55  reporter, or anyone else, thinks the next planned release is too far away
56  then a separate earlier release for security reasons should be considered.
57
58- Write a security advisory draft about the problem that explains what the
59  problem is, its impact, which versions it affects, solutions or
60  workarounds, when the release is out and make sure to credit all
61  contributors properly.
62
63- Request a CVE number from
64  [distros@openwall](http://oss-security.openwall.org/wiki/mailing-lists/distros)
65  when also informing and preparing them for the upcoming public security
66  vulnerability announcement - attach the advisory draft for information. Note
67  that 'distros' won't accept an embargo longer than 19 days.
68
69- Update the "security advisory" with the CVE number.
70
71- The security team commits the fix in a private branch. The commit message
72  should ideally contain the CVE number. This fix is usually also distributed
73  to the 'distros' mailing list to allow them to use the fix prior to the
74  public announcement.
75
76- At the day of the next release, the private branch is merged into the master
77  branch and pushed. Once pushed, the information is accessible to the public
78  and the actual release should follow suit immediately afterwards.
79
80- The project team creates a release that includes the fix.
81
82- The project team announces the release and the vulnerability to the world in
83  the same manner we always announce releases. It gets sent to the c-ares
84  mailing list and the oss-security mailing list.
85
86- The security web page on the web site should get the new vulnerability
87  mentioned.
88
89C-ARES-SECURITY (at haxx dot se)
90--------------------------------
91
92Who is on this list? There are a couple of criteria you must meet, and then we
93might ask you to join the list or you can ask to join it. It really isn't very
94formal. We basically only require that you have a long-term presence in the
95c-ares project and you have shown an understanding for the project and its way
96of working. You must've been around for a good while and you should have no
97plans in vanishing in the near future.
98
99We do not make the list of partipants public mostly because it tends to vary
100somewhat over time and a list somewhere will only risk getting outdated.
101