Handling a Security Advisory - deegree/deegree3 GitHub Wiki

Handling a security advisory for deegree3

  1. Review the advisory: Check the report on the repository’s Security Advisories page (triage). Confirm it is complete and plausible, that it affects a supported version per the policy, and rate its severity. Keep all details private and work only inside the advisory.
  2. Test the vulnerability: Reproduce the issue with the reporter’s steps on an affected version. Record the affected versions in the advisory page and the exact conditions in the description. If you cannot reproduce it, ask the reporter for more information in the advisory.
  3. Move it to draft: Now move the advisory from triage to draft!
  4. Create a private fork and branch: Use “Create a temporary private fork” from the advisory and add a branch for the fix there (for example fix/GHSA-xxxx) as it is described on the page. This keeps the fix hidden until it is released!
  5. Prepare the fix: Implement the fix and commit it to that branch as it is described. Add a regression test that fails without the fix and passes with it.
  6. Build the branch and verify the fix: Run the full build and test suite, then repeat the exploit from step 2 against the fixed build to confirm it no longer works. Check that nothing else broke.
  7. Document the outcome in the advisory: Add comments with the reproduction result, the fix description, the build and test results, and the verification result to the advisory.
  8. Pair review and TMC confirmation: A second person reviews the fix and the tests. At least one TMC member then confirms in the advisory that the fix and the tests are complete. Document this in the advisory additional to the regular TMC chat log protocol!
  9. Merge the fix: Merge the fix into the main branch (and into the supported maintenance branch, if needed) via the advisory’s private fork, then publish the advisory once the release is available.
  10. Build a release version: Follow the steps to build a release and create the release notes.
  11. Add a note to the release notes: Describe the vulnerability, the affected and fixed versions, the advisory or CVE reference, and credit the reporter, if they agree.
  12. Move it to published: As soon as the fix version is public available, publish the advisory and move it to published.