From: Ian Jackson Date: Fri, 16 Jan 2015 19:50:49 +0000 (+0000) Subject: Deployment with Security Team Permission X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=11d44520281e9dcbc4359090ca36d66f3b27c339;p=people%2Flarsk%2Fsecurity-process.git Deployment with Security Team Permission Permitting deployment during embargo seemed to have rough consensus on the principle. We seemed to be converging on the idea that the Security Team should explicitly set deployment restrictions for each set of patches. IMPLEMENTATION TASKS: * Add new section to Security Team's advisory template. * Add new section to any existing outstanding embargoed advisories. Signed-off-by: Ian Jackson Signed-off-by: Ian Jackson --- diff --git a/security_vulnerability_process.html b/security_vulnerability_process.html index 010cf76..de5e83e 100644 --- a/security_vulnerability_process.html +++ b/security_vulnerability_process.html @@ -212,6 +212,17 @@ following:

  • The assigned XSA number
  • The planned disclosure date
    • +

    List members may, if (and only if) the Security Team grants +permission, deploy fixed versions during the embargo. Permission for +deployment, and any restrictions, will be stated in the embargoed +advisory text.

    +

    The Security Team will normally permit such deployment, even for +systems where VMs are managed or used by non-members of the +predisclosure list. The Security Team will impose deployment +restrictions only insofar as it is necessary to prevent the exposure +of technicalities (for example, differences in behaviour) which +present a significant risk of rediscovery of the vulnerability. Such +situations are expected to be rare.

    NOTE: Prior v2.2 of this policy (25 June 2014) it was permitted to also make available the allocated CVE number. This is no longer permitted in accordance with MITRE policy.