From Fedora Project Wiki
(Added FST logo) |
(Moved text to the work flow page. Commented out CVE information.) |
||
| Line 28: | Line 28: | ||
We help package maintainers follow up with upstream developers to obtain a patch or a new release which fixes the issue. Once such patch or a new release is available, the package maintainer then builds a new version of the package and submits an update to the Fedora or EPEL repositories via [https://admin.fedoraproject.org/updates/ Bodhi]. | We help package maintainers follow up with upstream developers to obtain a patch or a new release which fixes the issue. Once such patch or a new release is available, the package maintainer then builds a new version of the package and submits an update to the Fedora or EPEL repositories via [https://admin.fedoraproject.org/updates/ Bodhi]. | ||
<!-- | |||
=== [https://cve.mitre.org/ CVEs] === | === [https://cve.mitre.org/ CVEs] === | ||
| Line 34: | Line 35: | ||
For each assigned CVE two bugs are created: one is the parent bug which describes the issue in human understandable details and lists available fixes and a second is the child bug which is used to track progression of these fixes into individual products(Fedora, Fedora-EPEL etc.). The parent bug is a generic one; it is opened against '''Component: vulnerability'''. Child bugs are specific; they are opened against '''Component: <package-name>''' of an individual product and are marked with '''keywords: SecurityTracking'''. | For each assigned CVE two bugs are created: one is the parent bug which describes the issue in human understandable details and lists available fixes and a second is the child bug which is used to track progression of these fixes into individual products(Fedora, Fedora-EPEL etc.). The parent bug is a generic one; it is opened against '''Component: vulnerability'''. Child bugs are specific; they are opened against '''Component: <package-name>''' of an individual product and are marked with '''keywords: SecurityTracking'''. | ||
--> | |||
== How to get involved == | == How to get involved == | ||
=== Joining the team === | === Joining the team === | ||
| Line 40: | Line 42: | ||
# subscribe to the {{fplist|security-team}} mailing list | # subscribe to the {{fplist|security-team}} mailing list | ||
# join us on the {{fpchat|#fedora-security-team}} IRC channel | # join us on the {{fpchat|#fedora-security-team}} IRC channel | ||
# read the [[ | # read the [[Security_Team_Work_Flow|work flow]] | ||
Once you feel comfortable just jump in and start helping. If you have questions please ask on IRC or on the mailing list. | Once you feel comfortable just jump in and start helping. If you have questions please ask on IRC or on the mailing list. | ||
Also, please take a look at the proposed [[Security Team Apprenticeship]] program as this may help answer additional questions. | Also, please take a look at the proposed [[Security Team Apprenticeship]] program as this may help answer additional questions. | ||
{{:Security Team Hall of Fame}} | {{:Security Team Hall of Fame}} | ||
[[Category:Security]] | [[Category:Security]] | ||
Revision as of 16:43, 19 August 2016
Mission
To provide the utmost secure operating environment to Fedora and EPEL users by:
- working with packagers to patch and update packages,
- identifying and helping to improve secure development practices,
- answering software security questions from the community.
Contact
If you need help or assistance with any issue, please feel free to contact the FST members at
- IRC:
- #fedora-security[?] - general security questions
- #fedora-security-team[?] - Security Team IRC channel for working vulnerabilities
- Mailing lists:
- security - General security mailing list (good for questions)
- security-team - Security Team mailing list
- Weekly meetings:
- Every Thursday at 14:00 UTC. -> Schedule and Agenda
Security Response
To report a vulnerability in software please follow the procedure outlined on the Security Bugs page.
To report a security concern within the Fedora Project please email security at fedoraproject dot org.
What we do
Fedora Security Team aims to ensure that users are protected from vulnerabilities that exist in Fedora packages. Vulnerabilities are reported to Fedora package maintainers via Bugzilla by Red Hat Product Security. These bugs are marked with keywords: SecurityTracking attribute in Bugzilla, for ex. => CVE-2013-0333 rubygem-activesupport: json to yaml parsing. The SecurityTracking keyword indicates that the bug could have security implications which need to be investigated.
We help package maintainers follow up with upstream developers to obtain a patch or a new release which fixes the issue. Once such patch or a new release is available, the package maintainer then builds a new version of the package and submits an update to the Fedora or EPEL repositories via Bodhi.
How to get involved
Joining the team
Joining the Fedora Security Team is an easy, three-step process:
- subscribe to the security-team mailing list
- join us on the #fedora-security-team[?] IRC channel
- read the work flow
Once you feel comfortable just jump in and start helping. If you have questions please ask on IRC or on the mailing list.
Also, please take a look at the proposed Security Team Apprenticeship program as this may help answer additional questions.