...
Code Block | ||||
---|---|---|---|---|
| ||||
Dear {reporter}, Thank you for your report. We confirm reception of your report. We still did not classified your report but we would like to ensure you that we are looking into this. We have created a private security issue in JIRA to track this issue: {jira_issue_url} If you would like to participate in this ticket please provide us your JIRA username. We will provide you update on your report status as soon as possible. -- Thanks {onap_vulnerability_ sub-committee _member}, on behalf of the ONAP vulnerability sub-committee |
...
Code Block | ||||
---|---|---|---|---|
| ||||
Dear {reporter}, This issue has been confirmed as a security vulnerability in { project }. The initially assign severity level is: {severity level}. Please let us know if you disagree with our assessment. We would like to get it fixed under the ONAP embargoed security vulnerability process. Please do not discuss or disclose details about this flaw prior to the agreed disclosure date (TBA). All decisions, discussions, and proposed patches and reviews are to be done via this tracking issue: {jira_issue_url} In general we will request for a CVE number for every confirmed security vulnerability to ensure full traceability. Please let us know if you have already obtained a CVE number for this issue in order to avoid duplicates. -- Thanks {onap_vulnerability_ sub-committee _member}, on behalf of the ONAP vulnerability sub-committee |
...
Code Block | ||||
---|---|---|---|---|
| ||||
Dear {reporter}, We have developed a patch that fixes the reported issue. The allocated CVE number is: {CVE id} Now we are approaching final step of our process which is coordinated disclosure. We scheduled the publication date to {publication date}. Please contact us immediately if you would like us to modify the disclosure date. Thank you very much for following responsible disclosure model. -- {onap_vulnerability_ sub-committee _member}, on behalf of the ONAP vulnerability sub-committee |
...
Code Block | ||||
---|---|---|---|---|
| ||||
This is an advance warning of a vulnerability discovered in
ONAP, to give you, as downstream stakeholders, a chance to
coordinate the release of fixes and reduce the vulnerability window.
Please treat the following information as confidential until the
proposed public disclosure date.
$DESCRIPTION
Proposed patch:
See attached patches. Unless a flaw is discovered in them, these
patches will be merged to their corresponding branches on the public
disclosure date.
CVE: $CVE
Proposed public disclosure date/time:
$DISCLOSURE, 1400UTC
Please do not make the issue public (or release public patches)
before this coordinated embargo date.
Original private report:
{jira_issue_url}
For access to read and comment on this report, please reply to me
with your jira username and I will subscribe you.
--
{onap_vulnerability_ sub-committee _member},
on behalf of the ONAP vulnerability sub-committee
|
...