1"use strict";(self.webpackChunksaurus=self.webpackChunksaurus||[]).push([[18928],{13656:(e,i,r)=>{r.r(i),r.d(i,{assets:()=>c,contentTitle:()=>o,default:()=>u,frontMatter:()=>l,metadata:()=>n,toc:()=>a});const n=JSON.parse('{"id":"security/index","title":"Vulnerability Management and Incident Response Policy","description":"For a quick overview of how to report vulnerabilities, see the organization-wide SECURITY.md file, which applies to all repositories under the osbuild GitHub organization.","source":"@site/docs/security/00-index.md","sourceDirName":"security","slug":"/security/index","permalink":"/docs/security/index","draft":false,"unlisted":false,"editUrl":"https://github.com/osbuild/osbuild.github.io/tree/main/docs/security/00-index.md","tags":[],"version":"current","sidebarPosition":0,"frontMatter":{},"sidebar":"security"}');var t=r(74848),s=r(28453);const l={},o="Vulnerability Management and Incident Response Policy",c={},a=[{value:"1. Reporting",id:"1-reporting",level:2},{value:"2. Triage and Response",id:"2-triage-and-response",level:2},{value:"3. Public Disclosure",id:"3-public-disclosure",level:2},{value:"4. EU Cyber Resilience Act",id:"4-eu-cyber-resilience-act",level:2}];function d(e){const i={a:"a",h1:"h1",h2:"h2",header:"header",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(i.header,{children:(0,t.jsx)(i.h1,{id:"vulnerability-management-and-incident-response-policy",children:"Vulnerability Management and Incident Response Policy"})}),"\n",(0,t.jsxs)(i.p,{children:["For a quick overview of how to report vulnerabilities, see the organization-wide ",(0,t.jsx)(i.a,{href:"https://github.com/osbuild/.github/blob/main/SECURITY.md",children:"SECURITY.md"})," file, which applies to all repositories under the osbuild GitHub organization."]}),"\n",(0,t.jsx)(i.h2,{id:"1-reporting",children:"1. Reporting"}),"\n",(0,t.jsxs)(i.ul,{children:["\n",(0,t.jsxs)(i.li,{children:["Report security vulnerabilities via email to ",(0,t.jsx)(i.a,{href:"mailto:[email protected]",children:"[email protected]"}),"."]}),"\n",(0,t.jsx)(i.li,{children:"Do not open public issues or submit public pull requests for undisclosed security vulnerabilities."}),"\n",(0,t.jsx)(i.li,{children:"Include a technical description, steps to reproduce, a proof of concept (if available), and the suspected impact."}),"\n"]}),"\n",(0,t.jsx)(i.h2,{id:"2-triage-and-response",children:"2. Triage and Response"}),"\n",(0,t.jsxs)(i.ul,{children:["\n",(0,t.jsx)(i.li,{children:"The core maintainer team will acknowledge receipt of the vulnerability report within 72 hours."}),"\n",(0,t.jsx)(i.li,{children:"The incident response team will assign a severity level during triage."}),"\n",(0,t.jsx)(i.li,{children:"The reporter may receive status updates weekly through the email address used to report the vulnerability."}),"\n"]}),"\n",(0,t.jsx)(i.h2,{id:"3-public-disclosure",children:"3. Public Disclosure"}),"\n",(0,t.jsxs)(i.ul,{children:["\n",(0,t.jsx)(i.li,{children:"Public disclosure occurs strictly after a patch is released and integrated into the primary branch."}),"\n",(0,t.jsx)(i.li,{children:"A CVE identifier will be requested when appropriate."}),"\n",(0,t.jsx)(i.li,{children:"The reporter will be credited in the public security advisory and release notes unless anonymity is explicitly requested."}),"\n"]}),"\n",(0,t.jsx)(i.h2,{id:"4-eu-cyber-resilience-act",children:"4. EU Cyber Resilience Act"}),"\n",(0,t.jsxs)(i.p,{children:["This project is stewarded by ",(0,t.jsx)(i.strong,{children:"Red Hat, Inc."}),", an open source software steward as defined in Article 3(14) of the ",(0,t.jsx)(i.a,{href:"https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng",children:"EU Cyber Resilience Act (Regulation 2024/2847)"}),". Contact: ",(0,t.jsx)(i.a,{href:"mailto:[email protected]",children:"[email protected]"})]}),"\n",(0,t.jsxs)(i.p,{children:["If you become aware of an ",(0,t.jsx)(i.strong,{children:"actively exploited vulnerability"})," or a ",(0,t.jsx)(i.strong,{children:"severe incident"})," affecting this project, please report it promptly \u2014 see ",(0,t.jsx)(i.a,{href:"https://github.com/RedHatProductSecurity/CRA/blob/main/Guidelines/eu-cra-incident-and-vulnerability-reporting-guidelines.md",children:"Reporting Actively Exploited Vulnerabilities and Severe Incidents"})," for the process and timelines."]}),"\n",(0,t.jsxs)(i.p,{children:["For Red Hat's general security practices, see ",(0,t.jsx)(i.a,{href:"https://access.redhat.com/security/",children:"Red Hat Product Security"}),"."]})]})}function u(e={}){const{wrapper:i}={...(0,s.R)(),...e.components};return i?(0,t.jsx)(i,{...e,children:(0,t.jsx)(d,{...e})}):d(e)}},28453:(e,i,r)=>{r.d(i,{R:()=>l,x:()=>o});var n=r(96540);const t={},s=n.createContext(t);function l(e){const i=n.useContext(s);return n.useMemo((function(){return"function"==typeof e?e(i):{...i,...e}}),[i,e])}function o(e){let i;return i=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:l(e.components),n.createElement(s.Provider,{value:i},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.