diff --git a/SECURITY.md b/SECURITY.md index cfd93f10e..f44d1fdfc 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,12 +1,12 @@ # Security Announcements -Join the [cubefs-security@groups.io](mailto:cubefs-security@groups.io) group for emails about security and major announcements. +Join the [security@cubefs.groups.io](mailto:security@cubefs.groups.io) group for emails about security and major announcements. ## Report a Vulnerability We’re extremely grateful for security researchers and users that report vulnerabilities to the CubeFS Open Source Community. All reports are thoroughly investigated by a dedicated committee of community volunteers called [Product Security Committee](./security/security-release-process.md#product-security-committee). -To make a report, please email the private [cubefs-security@groups.io](mailto:cubefs-security@groups.io) list with the security details and the details expected for [all CubeFS bug reports](https://github.com/cubefs/cubefs/blob/master/CONTRIBUTING.md#bug-reports). +To make a report, please email the private [security@cubefs.groups.io](mailto:security@cubefs.groups.io) list with the security details and the details expected for [all CubeFS bug reports](https://github.com/cubefs/cubefs/blob/master/CONTRIBUTING.md#bug-reports). ### When Should I Report a Vulnerability? diff --git a/security/email-templates.md b/security/email-templates.md index 809bdeb0f..b7a2481cd 100644 --- a/security/email-templates.md +++ b/security/email-templates.md @@ -6,7 +6,7 @@ This is a collection of email templates to handle various situations the securit ``` Subject: Upcoming security release of CubeFS $VERSION -To: cubefs-users@groups.io +To: security@cubefs.groups.io Hello CubeFS Community, @@ -32,7 +32,7 @@ $PERSON on behalf of the CubeFS Product Security Committee and maintainers ``` Subject: Security release of CubeFS $VERSION is now available -To: cubefs-users@groups.io +To: security@cubefs.groups.io Hello CubeFS Community, diff --git a/security/security-release-process.md b/security/security-release-process.md index 416728378..93fa3aa09 100644 --- a/security/security-release-process.md +++ b/security/security-release-process.md @@ -24,7 +24,7 @@ The PSC members will share various tasks as listed below: ### Contacting the Product Security Committee -Contact the team by sending email to [cubefs-users@groups.io](mailto:cubefs-users@groups.io) +Contact the team by sending email to [security@cubefs.groups.io](mailto:security@cubefs.groups.io) ### Product Security Committee Membership @@ -57,7 +57,7 @@ The CubeFS Community asks that all suspected vulnerabilities be privately and re ### Public Disclosure Processes -If anyone knows of a publicly disclosed security vulnerability please IMMEDIATELY email [cubefs-users@groups.io](mailto:cubefs-users@groups.io) to inform the PSC about the vulnerability so they may start the patch, release, and communication process. +If anyone knows of a publicly disclosed security vulnerability please IMMEDIATELY email [security@cubefs.groups.io](mailto:security@cubefs.groups.io) to inform the PSC about the vulnerability so they may start the patch, release, and communication process. If possible the PSC will ask the person making the public report if the issue can be handled via a private disclosure process. If the reporter denies the PSC will move swiftly with the fix and release process. In extreme cases GitHub can be asked to delete the issue but this generally isn't necessary and is unlikely to make a public disclosure less damaging. @@ -92,7 +92,7 @@ If the CVSS score is under ~4.0 Note: CVSS is convenient but imperfect. Ultimately, the PSC has discretion on classifying the severity of a vulnerability. -The severity of the bug and related handling decisions must be discussed on the cubefs-users@groups.io mailing list. +The severity of the bug and related handling decisions must be discussed on the security@cubefs.groups.io mailing list. ### Fix Disclosure Process @@ -104,11 +104,11 @@ With the Fix Development underway, the PSC needs to come up with an overall comm - The CubeFS maintainers will merge these PRs as quickly as possible. - The PSC will ensure all the binaries are built, publicly available, and functional. - The PSC will announce the new releases, the CVE number, severity, and impact, and the location of the binaries to get wide distribution and user action. As much as possible this announcement should be actionable, and include any mitigating steps users can take prior to upgrading to a fixed version. The recommended target time is 4pm UTC on a non-Friday weekday. This means the announcement will be seen morning Pacific, early evening Europe, and late evening Asia. The announcement will be sent via the following channels: - - cubefs-users@groups.io + - security@cubefs.groups.io ## Retrospective These steps should be completed 1-3 days after the Release Date. The retrospective process [should be blameless](https://landing.google.com/sre/book/chapters/postmortem-culture.html). -- The PSC will send a retrospective of the process to cubefs-users@groups.io including details on everyone involved, the timeline of the process, links to relevant PRs that introduced the issue, if relevant, and any critiques of the response and release process. -- The PSC and Fix Team are also encouraged to send their own feedback on the process to cubefs-users@groups.io. Honest critique is the only way we are going to get good at this as a community. +- The PSC will send a retrospective of the process to security@cubefs.groups.io including details on everyone involved, the timeline of the process, links to relevant PRs that introduced the issue, if relevant, and any critiques of the response and release process. +- The PSC and Fix Team are also encouraged to send their own feedback on the process to security@cubefs.groups.io. Honest critique is the only way we are going to get good at this as a community.