This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Summit 2011 Working Sessions/Session203/Deliverable 1"
| Line 2: | Line 2: | ||
'''OWASP Project Disclosure Policy''' | '''OWASP Project Disclosure Policy''' | ||
| + | |||
| + | = What to do if you find a vulnerability = | ||
| + | If you find a vulnerability in an OWASP branded software library or tool, you can send details of that vulnerability to [mailto:[email protected] [email protected]]. Please be sure to include as many details as you can about the vulnerability, a Proof Of Concept if one has been created, and your contact information so that the OWASP Global Projects Committee can stay in contact with you and credit the discovery to you. | ||
| + | |||
| + | Once we have received your initial contact, the GPC will acknowledge your report and create an issue to track the life cycle of the vulnerability. In the acknowledgment e-mail, you will receive a reference number with which to refer to the vulnerability in subsequent communications, as well as an outline of the vulnerability lifecycle described below. | ||
| + | |||
| + | == Initial Contact == | ||
| + | The Global Projects Committee (GPC) will notify the security liason or leader of the project if a security liaison is not assigned as listed on the project information page of the issue, along with any details provided by the discoverer and a reference to the open issue in the GPC Security Issue Vulnerability Database. It is expected that project leaders or other personnel from the project acknowledge the vulnerability within seven (7) days of initial contact. This acknowledgment should present an estimate of the expected time to resolve the issue and if available, a workaround solution that can be provided to users who subscribe to the [email protected] mailing list as well as users subscribed to the security-alerts@[project].owasp.org mailing list. | ||
| + | |||
| + | == Second Contact == | ||
| + | If no response from the project leader has been received within seven (7) days of initial contact, the GPC will send a second notice to the security liaison or project leader as well as other management staff listed on the project information page. The project staff will have seven (7) days from the time of second contact or fourteen (14) days from the date of initial contact to respond with an acknowledgment to the GPC. | ||
| + | |||
| + | == Final Contact == | ||
| + | |||
| + | If, after fourteen (14) days from initial contact with the project staff, the GPC has received no response from the project staff, a third and final email will be sent to the security liaison, project leader, and all committers on the project. The project will have fourteen (14) days from the data of final contact or twenty eight (28) days from the date of initial contact to respond with an acknowledgment to the GPC. | ||
| + | |||
| + | == Resolution == | ||
| + | |||
| + | The project will have one hundred eighty (180) days from the date of initial contact to resolve the issue and notify the GPC of the resolution. Resolution should be one of the following top level conditions. | ||
| + | |||
| + | === Vulnerability Fixed === | ||
| + | If the project team has fixed the vulnerability, the GPC Vulnerability Database should be updated with a status of "Fixed" and a patch to the code should be checked into the projects SCM as well as test cases to ensure the issue is resolved. In addition, a patch-level release to the project should be released. | ||
| + | |||
| + | === Won't Fix === | ||
| + | If the project team has determined that the issue will not be fixed, they should notify the GPC of this decision in writing with a detailed explanation of why and how the decision was reached. In addition the security liaison or project leader should update the GPC Vulnerability Database with a status of "Wont Fix". | ||
| + | |||
| + | === More Time Needed === | ||
| + | If resolution of the vulnerability is unusually complex or difficult to implement, the project team can request an extension of time from the GPC. To request an extension, the security liaison or project leader should send an email to the GPC with a detailed description of why the issue is particularly complex to solve and why more time is needed to do so. The GPC will hold a vote on whether the extension will be granted. The extension will be valid for thirty (30) days beyond one hundred eighty (180) day limit. | ||
| + | |||
| + | == Disclosure == | ||
| + | |||
| + | == | ||
| + | |||
| + | = What you need to know if you are a user = | ||
| + | |||
| + | |||
| + | = What you need to know if you are a project leader = | ||
| + | |||
| + | |||
| + | = Working Session Notes = | ||
Ack. From Leader of Issue | Ack. From Leader of Issue | ||
| Line 15: | Line 55: | ||
The maximum resolution period that will be granted cannot extend beyond 365 from the date of initial contact. | The maximum resolution period that will be granted cannot extend beyond 365 from the date of initial contact. | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
Revision as of 19:27, 11 February 2011
Deliverable 1
OWASP Project Disclosure Policy
What to do if you find a vulnerability
If you find a vulnerability in an OWASP branded software library or tool, you can send details of that vulnerability to [email protected]. Please be sure to include as many details as you can about the vulnerability, a Proof Of Concept if one has been created, and your contact information so that the OWASP Global Projects Committee can stay in contact with you and credit the discovery to you.
Once we have received your initial contact, the GPC will acknowledge your report and create an issue to track the life cycle of the vulnerability. In the acknowledgment e-mail, you will receive a reference number with which to refer to the vulnerability in subsequent communications, as well as an outline of the vulnerability lifecycle described below.
Initial Contact
The Global Projects Committee (GPC) will notify the security liason or leader of the project if a security liaison is not assigned as listed on the project information page of the issue, along with any details provided by the discoverer and a reference to the open issue in the GPC Security Issue Vulnerability Database. It is expected that project leaders or other personnel from the project acknowledge the vulnerability within seven (7) days of initial contact. This acknowledgment should present an estimate of the expected time to resolve the issue and if available, a workaround solution that can be provided to users who subscribe to the [email protected] mailing list as well as users subscribed to the security-alerts@[project].owasp.org mailing list.
Second Contact
If no response from the project leader has been received within seven (7) days of initial contact, the GPC will send a second notice to the security liaison or project leader as well as other management staff listed on the project information page. The project staff will have seven (7) days from the time of second contact or fourteen (14) days from the date of initial contact to respond with an acknowledgment to the GPC.
Final Contact
If, after fourteen (14) days from initial contact with the project staff, the GPC has received no response from the project staff, a third and final email will be sent to the security liaison, project leader, and all committers on the project. The project will have fourteen (14) days from the data of final contact or twenty eight (28) days from the date of initial contact to respond with an acknowledgment to the GPC.
Resolution
The project will have one hundred eighty (180) days from the date of initial contact to resolve the issue and notify the GPC of the resolution. Resolution should be one of the following top level conditions.
Vulnerability Fixed
If the project team has fixed the vulnerability, the GPC Vulnerability Database should be updated with a status of "Fixed" and a patch to the code should be checked into the projects SCM as well as test cases to ensure the issue is resolved. In addition, a patch-level release to the project should be released.
Won't Fix
If the project team has determined that the issue will not be fixed, they should notify the GPC of this decision in writing with a detailed explanation of why and how the decision was reached. In addition the security liaison or project leader should update the GPC Vulnerability Database with a status of "Wont Fix".
More Time Needed
If resolution of the vulnerability is unusually complex or difficult to implement, the project team can request an extension of time from the GPC. To request an extension, the security liaison or project leader should send an email to the GPC with a detailed description of why the issue is particularly complex to solve and why more time is needed to do so. The GPC will hold a vote on whether the extension will be granted. The extension will be valid for thirty (30) days beyond one hundred eighty (180) day limit.
Disclosure
==
What you need to know if you are a user
What you need to know if you are a project leader
Working Session Notes
Ack. From Leader of Issue
First Notice to Project Leaders - Response Expected within 7 days from initial notice to leader Second Notice to Project Leaders - Response Expected within 14 days from initial notice to leader Final Notice to Project Leaders - Response Expected within 30 days from initial notice to leader
If no ack of issue, full disclosure or disclosure of the issue will be released. Full or partial disclosure to be determined and voted on by GPC on a case by case basis.
Ack. of Resolution within 180 days of initial contact
- if project leader provides detailed explanation of why a fix will take longer, GPC can decide to extend the disclosure period in 30 day increments.
The maximum resolution period that will be granted cannot extend beyond 365 from the date of initial contact.
