From: "Johannes Schindelin via GitGitGadget" <email@example.com>
Cc: Johannes Schindelin <firstname.lastname@example.org>,
Johannes Schindelin <email@example.com>
Subject: [PATCH 1/2] SECURITY: describe how to report vulnerabilities
Date: Fri, 26 Mar 2021 22:12:45 +0000 [thread overview]
Message-ID: <firstname.lastname@example.org> (raw)
From: Johannes Schindelin <email@example.com>
In the same document, describe that Git does not have Long Term Support
(LTS) release trains, although security fixes are always applied to a
few of the most recent release trains.
Signed-off-by: Johannes Schindelin <firstname.lastname@example.org>
SECURITY.md | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 51 insertions(+)
create mode 100644 SECURITY.md
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
@@ -0,0 +1,51 @@
+# Security Policy
+## Reporting a vulnerability
+Please send a detailed mail to email@example.com to
+report vulnerabilities in Git.
+Even when unsure whether the bug in question is an exploitable
+vulnerability, it is recommended to send the report to
+firstname.lastname@example.org (and obviously not to discuss the
+issue anywhere else).
+Vulnerabilities are expected to be discussed _only_ on that
+list, and not in public, until the official announcement on the
+Git mailing list on the release date.
+Examples for details to include:
+- Ideally a short description (or a script) to demonstrate an
+- The affected platforms and scenarios (the vulnerability might
+ only affect setups with case-sensitiv file systems, for
+- The name and affiliation of the security researchers who are
+ involved in the discovery, if any.
+- Whether the vulnerability has already been disclosed.
+- How long an embargo would be required to be safe.
+## Supported Versions
+There are no official "Long Term Support" versions in Git.
+Instead, the maintenance track (i.e. the versions based on the
+most recently published feature release, also known as ".0"
+version) sees occasional updates with bug fixes.
+Fixes to vulnerabilities are made for the maintenance track for
+the latest feature release and merged up to the in-development
+branches. The Git project makes no formal guarantee for any
+older maintenance tracks to receive updates. In practice,
+though, critical vulnerability fixes are applied not only to the
+most recent track, but to at least a couple more maintenance
+This is typically done by making the fix on the oldest and still
+relevant maintenance track, and merging it upwards to newer and
+newer maintenance tracks.
+For example, v2.24.1 was released to address a couple of
+[CVEs](https://cve.mitre.org/), and at the same time v2.14.6,
+v2.15.4, v2.16.6, v2.17.3, v2.18.2, v2.19.3, v2.20.2, v2.21.1,
+v2.22.2 and v2.23.1 were released.
next prev parent reply other threads:[~2021-03-26 22:13 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-26 22:12 [PATCH 0/2] Describe Git's security policy Johannes Schindelin via GitGitGadget
2021-03-26 22:12 ` Johannes Schindelin via GitGitGadget [this message]
2021-03-27 0:00 ` [PATCH 1/2] SECURITY: describe how to report vulnerabilities Denton Liu
2021-03-29 13:37 ` Johannes Schindelin
2021-03-27 6:34 ` Bagas Sanjaya
2021-03-29 13:41 ` Johannes Schindelin
2021-03-26 22:12 ` [PATCH 2/2] Document how we do embargoed releases Johannes Schindelin via GitGitGadget
2021-03-29 13:43 ` [PATCH v2 0/2] Describe Git's security policy Johannes Schindelin via GitGitGadget
2021-03-29 13:43 ` [PATCH v2 1/2] SECURITY: describe how to report vulnerabilities Johannes Schindelin via GitGitGadget
2021-03-29 13:43 ` [PATCH v2 2/2] Document how we do embargoed releases Johannes Schindelin via GitGitGadget
2021-04-20 19:50 ` [PATCH v2 2/2] Document how we do embargoed releases - improving mail template Robin H. Johnson
2021-04-20 21:51 ` Junio C Hamano
2021-04-20 22:45 ` Robin H. Johnson
2021-04-20 23:34 ` Junio C Hamano
2021-04-20 23:31 ` Junio C Hamano
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).