@@ -19,10 +19,10 @@ Resolving Process
19
19
For each report, we first try to confirm the vulnerability. When it is
20
20
confirmed, the core-team works on a solution following these steps:
21
21
22
- 1 . Send an acknowledgement to the reporter;
23
- 2 . Work on a patch;
24
- 3 . Get a CVE identifier from mitre.org;
25
- 4 . Write a security announcement for the official Symfony `blog `_ about the
22
+ # . Send an acknowledgement to the reporter;
23
+ # . Work on a patch;
24
+ # . Get a CVE identifier from mitre.org;
25
+ # . Write a security announcement for the official Symfony `blog `_ about the
26
26
vulnerability. This post should contain the following information:
27
27
28
28
* a title that always include the "Security release" string;
@@ -32,12 +32,12 @@ confirmed, the core-team works on a solution following these steps:
32
32
* how to patch/upgrade/workaround affected applications;
33
33
* the CVE identifier;
34
34
* credits.
35
- 5 . Send the patch and the announcement to the reporter for review;
36
- 6 . Apply the patch to all maintained versions of Symfony;
37
- 7 . Package new versions for all affected versions;
38
- 8 . Publish the post on the official Symfony `blog `_ (it must also be added to
35
+ # . Send the patch and the announcement to the reporter for review;
36
+ # . Apply the patch to all maintained versions of Symfony;
37
+ # . Package new versions for all affected versions;
38
+ # . Publish the post on the official Symfony `blog `_ (it must also be added to
39
39
the "`Security Advisories `_" category);
40
- 9 . Update the security advisory list (see below).
40
+ # . Update the security advisory list (see below).
41
41
42
42
.. note ::
43
43
@@ -61,23 +61,23 @@ As Symfony is used by many large Open-Source projects, we standardized the way
61
61
the Symfony security team collaborates on security issues with downstream
62
62
projects. The process works as follows:
63
63
64
- 1 . After the Symfony security team has acknowledged a security issue, it
65
- immediately sends an email to the downstream project security teams to inform
66
- them of the issue;
64
+ # . After the Symfony security team has acknowledged a security issue, it
65
+ immediately sends an email to the downstream project security teams to
66
+ inform them of the issue;
67
67
68
- 2 . The Symfony security team creates a private Git repository to ease the
69
- collaboration on the issue and access to this repository is given to the
70
- Symfony security team, to the Symfony contributors that are impacted by the
71
- issue, and to one representative of each downstream projects;
68
+ # . The Symfony security team creates a private Git repository to ease the
69
+ collaboration on the issue and access to this repository is given to the
70
+ Symfony security team, to the Symfony contributors that are impacted by
71
+ the issue, and to one representative of each downstream projects;
72
72
73
- 3 . All people with access to the private repository work on a solution to
74
- solve the issue via pull requests, code reviews, and comments;
73
+ # . All people with access to the private repository work on a solution to
74
+ solve the issue via pull requests, code reviews, and comments;
75
75
76
- 4 . Once the fix is found, all involved projects collaborate to find the best
77
- date for a joint release (there is no guarantee that all releases will be at
78
- the same time but we will try hard to make them at about the same time). When
79
- the issue is not known to be exploited in the wild, a period of two weeks
80
- seems like a reasonable amount of time.
76
+ # . Once the fix is found, all involved projects collaborate to find the best
77
+ date for a joint release (there is no guarantee that all releases will
78
+ be at the same time but we will try hard to make them at about the same
79
+ time). When the issue is not known to be exploited in the wild, a period
80
+ of two weeks seems like a reasonable amount of time.
81
81
82
82
The list of downstream projects participating in this process is kept as small
83
83
as possible in order to better manage the flow of confidential information
0 commit comments