From: Ian Jackson Date: Fri, 16 Jan 2015 19:51:11 +0000 (+0000) Subject: Explicitly permit within-list information sharing during embargo X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=2ac7f66499801401ebc87e2af4e5fcf5932b4b60;p=people%2Flarsk%2Fsecurity-process.git Explicitly permit within-list information sharing during embargo Permitting sharing of embargoed fixes amongst predisclosure list seemed to have appropriate consensus. IMPLEMENTATION TASKS: * Send a notification to the existing predisclosure list members informing them that they have been subscribed to the new list. Notice should point them to the policy section on filtering by List-Id, and offer to unsubscribe them from both lists if they prefer. * Create the new mailing list, and - check that it can be emailed from outside - that messages are held for moderation and can be approved Signed-off-by: Ian Jackson Signed-off-by: Ian Jackson --- v2: Obfuscate -discuss@ list's full email address with and . --- diff --git a/security_vulnerability_process.html b/security_vulnerability_process.html index de8fd44..2d32e51 100644 --- a/security_vulnerability_process.html +++ b/security_vulnerability_process.html @@ -224,6 +224,27 @@ situations are expected to be rare.

NOTE: Prior v2.2 of this policy (25 June 2014) it was permitted to also make available the allocated CVE number. This is no longer permitted in accordance with MITRE policy.

+

Information-sharing amongst predisclosure list members

+

Predisclosure list members are allowed to share fixes to embargoed issues, +analysis, etc., with the security teams of other list members. +Technical measures must be taken to prevents non-list-member +organisations, or unauthorised staff in list-member organisations, +from obtaining the embargoed materials.

+

The Xen Project provides the mailing list +xen-security-issues-discuss@lists.xenproject<dot>org +for this purpose. List members are encouraged to use it but +may share with other list members' security teams via other +channels.

+

The -discuss list's distribution is identical to that of the primary +predisclosure list xen-security-issues. Recipient organisations who +do not wish to receive all of the traffic on -discuss should use +recipient-side email filtering based on the provided List-Id.

+

The -discuss list is moderated by the Xen Project Security Team. +Announcements of private availability of fixed versions, and +technical messages about embargoed advisories, will be approved. +Messages dealing with policy matters will be rejected with a +reference to the Security Team contact address and/or public Xen +mailing lists.

Predisclosure list membership application process

Organisations who meet the criteria should contact predisclosure-applications@xenproject<dot>org