@@ -21,21 +21,23 @@ confirmed, the core-team works on a solution following these steps:
21
21
22
22
1. Send an acknowledgement to the reporter;
23
23
2. Work on a patch;
24
- 3. Write a security announcement for the official Symfony `blog `_ about the
24
+ 3. Get a CVE identifier from mitre.org;
25
+ 4. Write a security announcement for the official Symfony `blog `_ about the
25
26
vulnerability. This post should contain the following information:
26
27
27
28
* a title that always include the "Security release" string;
28
29
* a description of the vulnerability;
29
30
* the affected versions;
30
31
* the possible exploits;
31
32
* how to patch/upgrade/workaround affected applications;
33
+ * the CVE identifier;
32
34
* credits.
33
- 4 . Send the patch and the announcement to the reporter for review;
34
- 5 . Apply the patch to all maintained versions of Symfony;
35
- 6 . Package new versions for all affected versions;
36
- 7 . Publish the post on the official Symfony `blog `_ (it must also be added to
35
+ 5 . Send the patch and the announcement to the reporter for review;
36
+ 6 . Apply the patch to all maintained versions of Symfony;
37
+ 7 . Package new versions for all affected versions;
38
+ 8 . Publish the post on the official Symfony `blog `_ (it must also be added to
37
39
the "`Security Advisories `_" category);
38
- 8 . Update the security advisory list (see below).
40
+ 9 . Update the security advisory list (see below).
39
41
40
42
.. note ::
41
43
@@ -52,6 +54,7 @@ Security Advisories
52
54
This section indexes security vulnerabilities that were fixed in Symfony
53
55
releases, starting from Symfony 1.0.0:
54
56
57
+ * December 20, 2012: `Security release: Symfony 2.0.20 and 2.1.5 <http://symfony.com/blog/security-release-symfony-2-0-20-and-2-1-5-released >`_ (`CVE-2012-6431 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6431 >`_ and `CVE-2012-6432 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6432 >`_)
55
58
* November 29, 2012: `Security release: Symfony 2.0.19 and 2.1.4 <http://symfony.com/blog/security-release-symfony-2-0-19-and-2-1-4 >`_
56
59
* November 25, 2012: `Security release: symfony 1.4.20 released <http://symfony.com/blog/security-release-symfony-1-4-20-released >`_ (`CVE-2012-5574 <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5574 >`_)
57
60
* August 28, 2012: `Security Release: Symfony 2.0.17 released <http://symfony.com/blog/security-release-symfony-2-0-17-released >`_
0 commit comments