TWiki Security Alert Process

I discovered a security issue. Now What?

Important: In case you think that you discovered a security issue that could potentially compromise public TWiki installations, please send an e-mail to the SecurityTeam via the TWikiSecurityMailingList at mailto:twiki-security@listsPLEASENOSPAM.sourceforge.net. We will follow up in a timely manner with a fix and will inform administrators before the issue gets public.

How can I get notified of security issues?

• Please subscribe to the TWikiAnnounceMailingList to get updates on new TWiki releases and TWiki vulnerabilities in a timely manner.

Security Alert Process

As a free service, the TWiki team is trying its best to provide a hotfix and to send TWikiSecurityAlerts to TWiki site administrators in a timely manner.

Current process:

• Someone sends an e-mail to the SecurityTeam via the TWikiSecurityMailingList at mailto:twiki-security@listsPLEASENOSPAM.sourceforge.net
• The SecurityTeam triages the seriousness of the issue:
  • Severity 1 issue: The web server can be compromised
    • Example: Software can be installed and executed remotely
  • Severity 2 issue: The TWiki installation is compromised
    • Example: The access control of the admin group can be cirumvented
  • Severity 3 issue: TWiki content or browser is compromised
• Action for Severity 1 and 2 issues:
  • Verify issue
  • Create hotfix for affected TWikiProductionReleases
  • Request a CVE number
  • Silent alert: Alert TWikiDevMailingList members and TWikiAnnounceMailingList members
  • Public advisory: Issue a public security advisory after 2 day grace period, avoiding weekend
  • Create a patched TWikiProductionRelease or a HotFix for the latest production release within 7 days
• Action for Priority 3 issue:
  • File BugReport
  • Fix in development branch for upcoming TWikiProductionRelease (patch or major)

-- Contributors: PeterThoeny, KennethLavrsen - 2012-12-11

Discussions

Old discussions up to 2006 removed. They are accessible in rev 50 of this topic.

-- PeterThoeny - 2012-12-11