From 9d93d4abe185bffac28a29e182e18abac0782f18 Mon Sep 17 00:00:00 2001 From: Daniel Stenberg Date: Thu, 11 Jun 2026 09:46:09 +0200 Subject: [PATCH] SECURITY-ADVISORY.md: expand Fill in missing information and rephrase a little Closes #21964 --- docs/SECURITY-ADVISORY.md | 34 +++++++++++++++++++++++----------- 1 file changed, 23 insertions(+), 11 deletions(-) diff --git a/docs/SECURITY-ADVISORY.md b/docs/SECURITY-ADVISORY.md index 4f3e1df2c9..34c342509d 100644 --- a/docs/SECURITY-ADVISORY.md +++ b/docs/SECURITY-ADVISORY.md @@ -6,11 +6,14 @@ SPDX-License-Identifier: curl # Anatomy of a curl security advisory -As described in the [Security Process](https://curl.se/dev/secprocess.html) -document, when a security vulnerability has been reported to the project and -confirmed, we author an advisory document for the issue. It should ideally -be written in cooperation with the reporter to make sure all the angles and -details of the problem are gathered and described correctly and succinctly. +As described in the [vulnerability disclosure +policy](https://curl.se/dev/vuln-disclosure.html), when a vulnerability has +been reported to the project and and it has been confirmed by the team, we +author an advisory document for the issue. + +

This advisory document should ideally be written in cooperation with the +reporter to make sure all the angles and details of the problem are gathered +and described correctly and succinctly. ## New document @@ -31,13 +34,22 @@ in the same directory. It holds a large array with all published curl vulnerabilities. All fields should be filled in accordingly, separated by a pipe character (`|`). -The eleven fields for each CVE in `vuln.pm` are, in order: +The fields for every CVE in `vuln.pm` are, in order: -HTML page name, first vulnerable version, last vulnerable version, name of -the issue, CVE Id, announce date (`YYYYMMDD`), report to the project date -(`YYYYMMDD`), CWE, awarded reward amount (USD), area (single word), C-issue -(`-` if not a C issue at all, `OVERFLOW` , `OVERREAD`, `DOUBLE_FREE`, -`USE_AFTER_FREE`, `NULL_MISTAKE`, `UNINIT`) +1. HTML page name +2. first vulnerable version +3. last vulnerable version +4. name of the issue +5. CVE Id +6. announce date (`YYYYMMDD`) +7. report to the project date (`YYYYMMDD`) +8. CWE +9. awarded reward amount (USD) +10. area (single word) +11. C-issue (`-` if not a C issue at all, `OVERFLOW` , `OVERREAD`, `DOUBLE_FREE`, `USE_AFTER_FREE`, `NULL_MISTAKE`, `UNINIT`, `BAD_FREE`) +12. affected components: `both`, `lib` or `tool` +13. severity: `low`, `medium`, `high` or `critical` +14. URL to the initial report (often on HackerOne) ### `Makefile`