mirror of
https://github.com/torvalds/linux.git
synced 2024-09-20 23:13:00 +00:00
Documentation: security-bugs.rst: clarify CVE handling
The kernel security team does NOT assign CVEs, so document that properly and provide the "if you want one, ask MITRE for it" response that we give on a weekly basis in the document, so we don't have to constantly say it to everyone who asks. Link: https://lore.kernel.org/r/2023063022-retouch-kerosene-7e4a@gregkh Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
4fee0915e6
commit
3c1897ae4b
|
@ -79,13 +79,12 @@ not contribute to actually fixing any potential security problems.
|
||||||
CVE assignment
|
CVE assignment
|
||||||
--------------
|
--------------
|
||||||
|
|
||||||
The security team does not normally assign CVEs, nor do we require them
|
The security team does not assign CVEs, nor do we require them for
|
||||||
for reports or fixes, as this can needlessly complicate the process and
|
reports or fixes, as this can needlessly complicate the process and may
|
||||||
may delay the bug handling. If a reporter wishes to have a CVE identifier
|
delay the bug handling. If a reporter wishes to have a CVE identifier
|
||||||
assigned ahead of public disclosure, they will need to contact the private
|
assigned, they should find one by themselves, for example by contacting
|
||||||
linux-distros list, described above. When such a CVE identifier is known
|
MITRE directly. However under no circumstances will a patch inclusion
|
||||||
before a patch is provided, it is desirable to mention it in the commit
|
be delayed to wait for a CVE identifier to arrive.
|
||||||
message if the reporter agrees.
|
|
||||||
|
|
||||||
Non-disclosure agreements
|
Non-disclosure agreements
|
||||||
-------------------------
|
-------------------------
|
||||||
|
|
Loading…
Reference in New Issue
Block a user