Project

General

Profile

Forums » Development »

Proposal: HowTo handle security and other incidents

Added by Holger Just over 14 years ago

Hi all,

In #2359, Eric requested the mailing list to allow users to send security incidents to the core developers.
While this is a great thing, we still need a followed and publicly documented procedure to handle such incidents.

Following is my proposal for such a process:

  • Immediately auto-confirm the message OR manually confirm the message in no more than 24 hours
    • Keep the initial communication very discrete.
    • The response should include the internal issue ID.
  • Check, if this a real bug and confirm the result to the original sender ASAP
  • Assign a CVE Candidate Number
    • This number is then publicly stated in the final announcement
  • Prepare the patch using the private issue.
  • Check if the patch have to be backported.
    • It is important, that we explicitly state which versions / branches of Redmine are supported at a time.
    • All supported versions have to be patched at the same time.
  • Send an announcement to a semi-public list, which is aimed for developers trying to keep their systems clean. Do not immediately announce the security incident in every channel to allow admins to patch their systems in a reasonable time frame.
  • After about a week (?), create a public news entry stating at least
    • Description
    • the CVE ID
    • Affected versions
    • Impact
    • Solution / HowTo update or patch systems
  • Also create blog posts, IRC messages, ... only after the grace period.

Also, there should be a GPG key boldly included into SubmittingBugs to allow the sender to encrypt the sensitive incident message and any communication with the devs.

Any thoughts?
--Holger


Replies (3)

RE: Proposal: HowTo handle security and other incidents - Added by Holger Just over 14 years ago

Just for clarification, the initial response should not include the solution. It is just thought as a first conformation that the securoity team has received the notice and is looking at it.

Also here are some links how others handle this:

RE: Proposal: HowTo handle security and other incidents - Added by Holger Just over 14 years ago

Eric, I just found the request for an announcement list, I told you about. It in the thread Security distribution list?

--Holger

RE: Proposal: HowTo handle security and other incidents - Added by Eric Davis over 14 years ago

Holger:

(We've already talked about this on IRC, but for the rest of the community:)

In in ideal world, this plan would be great. The problem is that Redmine's developer team is very understaffed right now (it's only me and Jean-Philippe committing code and with security access). With the fixed 24 hour deadline, that means that Jean-Philippe or myself would have to be "on call" at all times, and that is not something I am willing to do.

An automated reply might work; but we'd need to add more infrastructure to support it and as it is, I don't have access to the Redmine.org server. Maybe Jean-Philippe could set something up for it?

What I would recommend is to take this proposal and convert it into a wiki page with all the details of the policy. Then we can figure out what work is needed. The less work required for a developer, the better (e.g. direct links to create a CVE number, template emails to use when replying, etc).

Eric Davis

    (1-3/3)