diff options
| author | Dmitriy Zaporozhets <dzaporozhets@gitlab.com> | 2015-03-10 03:38:03 +0000 |
|---|---|---|
| committer | Dmitriy Zaporozhets <dzaporozhets@gitlab.com> | 2015-03-10 03:38:03 +0000 |
| commit | d881a92795ab6a4ad68f27f6c7823777b5c0afc6 (patch) | |
| tree | 19c1314cebb53bd00a472b797e811781ddb8e8a1 | |
| parent | 21c99e6a7797edb6a857e90c83fee3e5f1051adc (diff) | |
| parent | ddd381c9a51b3408cf303283c466c7f70baf7e6a (diff) | |
| download | gitlab-ce-d881a92795ab6a4ad68f27f6c7823777b5c0afc6.tar.gz | |
Merge branch 'cve-if-needed' into 'master'
Add criteria for requesting CVE
For #1887. Based on https://dev.gitlab.org/gitlab/gitlabhq/issues/1945#note_34587
cc @sytse
See merge request !1662
| -rw-r--r-- | doc/release/security.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/doc/release/security.md b/doc/release/security.md index b67e0f37a04..1575fcf2708 100644 --- a/doc/release/security.md +++ b/doc/release/security.md @@ -22,7 +22,7 @@ Please report suspected security vulnerabilities in private to <support@gitlab.c 1. Merge and publish the blog posts 1. Send tweets about the release from `@gitlabhq` 1. Send out an email to [the community google mailing list](https://groups.google.com/forum/#!forum/gitlabhq) -1. Post a signed copy of our complete announcement to [oss-security](http://www.openwall.com/lists/oss-security/) and request a CVE number +1. Post a signed copy of our complete announcement to [oss-security](http://www.openwall.com/lists/oss-security/) and request a CVE number. CVE is only needed for bugs that allow someone to own the server (Remote Code Execution) or access to code of projects they are not a member of. 1. Add the security researcher to the [Security Researcher Acknowledgments list](http://about.gitlab.com/vulnerability-acknowledgements/) 1. Thank the security researcher in an email for their cooperation 1. Update the blog post and the CHANGELOG when we receive the CVE number |