NeoAnd/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2025-07-21 11:37:21 -06:00
Code Issues Actions 10 Packages Projects Releases Wiki Activity

Created Vulnerability Reporting (markdown)

Jeremy Stretch 2024-07-10 09:45:37 -04:00
parent 093160f4e5
commit 5c7081f554
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
Vulnerability-Reporting.md Normal file

@ -0,0 +1,12 @@
Per our [security policy](https://github.com/netbox-community/netbox/blob/develop/SECURITY.md), all potential vulnerabilities must be reported via email to `security@netboxlabs.com`.
Initial triage of vulnerability reports is handled by the NetBox Labs support team, and valid reports are forwarded to the NetBox maintainers team for further investigation. A NetBox maintainer will then:
* Validate the reported vulnerability
* Determine its impact and severity
* Create a (private) draft [GitHub security advisory](https://docs.github.com/en/code-security/security-advisories)
* Coordinate with other maintainers to devise and implement a solution
Once implemented, the solution will be shipped in the next stable release of NetBox. Particularly severe issues may warrant immediately releasing a new version of NetBox. Security advisories will be published after a stable release containing the fix has been available for some time.
Please note that we do not issue or respond to CVEs, as these reports are entirely unmoderated and often inaccurate, redundant, and/or overstated with regard to actual impact on the product. ([This article](https://www.bleepingcomputer.com/news/security/dev-rejects-cve-severity-makes-his-github-repo-read-only/) explores the challenges of dealing with nuisance CVEs.)