You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pulsar.apache.org by GitBox <gi...@apache.org> on 2022/08/02 13:56:08 UTC
[GitHub] [pulsar] hpvd opened a new issue, #16919: security: no advice on how to report vulnerabilities
hpvd opened a new issue, #16919:
URL: https://github.com/apache/pulsar/issues/16919
**Describe the bug**
security: no advice on how to report vulnerabilities
**To Reproduce**
Steps to reproduce the behavior:
1. https://github.com/apache/pulsar/issues/new/choose
2. https://github.com/apache/pulsar/security/policy
3. https://pulsar.apache.org/docs/security-policy-and-supported-versions/
see screenshot
**Expected behavior**
an advice how to report vulnerabilities:
or is it fine to just open an issue?
**Screenshots**
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] michaeljmarshall closed issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
michaeljmarshall closed issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
URL: https://github.com/apache/pulsar/issues/16919
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] lhotari commented on issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
lhotari commented on issue #16919:
URL: https://github.com/apache/pulsar/issues/16919#issuecomment-1209080158
https://pulsar.apache.org/docs/next/security-policy-and-supported-versions/ contains the new version, but it is missing from https://pulsar.apache.org/docs/security-policy-and-supported-versions/ . @Anonymitaet I'm reopening this issue until that is resolved.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] lhotari commented on issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
lhotari commented on issue #16919:
URL: https://github.com/apache/pulsar/issues/16919#issuecomment-1209191419
> @lhotari do you mean that we should cherry-pick (to master) this change to other versioned docs?
I guess that is need. In addition I think it's necessary to inline the information to SECURITY.md so that the information isn't missing at least from that page.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] Anonymitaet closed issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
Anonymitaet closed issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
URL: https://github.com/apache/pulsar/issues/16919
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] tisonkun commented on issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
tisonkun commented on issue #16919:
URL: https://github.com/apache/pulsar/issues/16919#issuecomment-1207568465
@Anonymitaet
The only link in SECURITY.md redirects users to "Security Policy and Supported Versions". To reduce confusion, either change the link to "Reporting a Vulnerability" or duplicate the info to the "Security Policy and Supported Versions" page. I prepare a patch of the latter way in #16962, you may give a review comment there.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] hpvd commented on issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
hpvd commented on issue #16919:
URL: https://github.com/apache/pulsar/issues/16919#issuecomment-1206126361
@sijie @Anonymitaet Do you have any idea/advice on this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] tisonkun commented on issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
tisonkun commented on issue #16919:
URL: https://github.com/apache/pulsar/issues/16919#issuecomment-1207082115
I'll prepare a patch and ask for PMC members to review.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] michaeljmarshall commented on issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
michaeljmarshall commented on issue #16919:
URL: https://github.com/apache/pulsar/issues/16919#issuecomment-1219084174
Thanks for following up @tisonkun, yes, I believe #17039 completes this issue. Please reopen the issue if you see any issues @hpvd.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] lhotari commented on issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
lhotari commented on issue #16919:
URL: https://github.com/apache/pulsar/issues/16919#issuecomment-1209199668
@Anonymitaet how can we get https://pulsar.apache.org/docs/security-policy-and-supported-versions/ to match what is seen at https://pulsar.apache.org/docs/next/security-policy-and-supported-versions/ (to include #16962 changes)?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] michaeljmarshall commented on issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
michaeljmarshall commented on issue #16919:
URL: https://github.com/apache/pulsar/issues/16919#issuecomment-1211011900
Great catch, @hpvd. I didn't realize I had missed advising _how_ to report a vulnerability. I agree with duplicating the information in the `SECURITY.md` file. This information won't change with any frequency, and it is imperative to make it easy to find.
I'd like to propose that we don't version the security page, but instead have some top level tab (or something like that) to make it easy to find and maintain.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] tisonkun commented on issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
tisonkun commented on issue #16919:
URL: https://github.com/apache/pulsar/issues/16919#issuecomment-1207081973
Hi @hpvd,
Thanks for reporting this issue! I think we can add a short statement to report security vulnerabilities via private mailing list or the ASF security mailing list.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] tisonkun commented on issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
tisonkun commented on issue #16919:
URL: https://github.com/apache/pulsar/issues/16919#issuecomment-1219079750
@michaeljmarshall shall we close this issue since #17039 merged? Or you'd like to complete it after we move the doc outside from versioned ones.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] Anonymitaet commented on issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
Anonymitaet commented on issue #16919:
URL: https://github.com/apache/pulsar/issues/16919#issuecomment-1210080077
@lhotari Do you mean bringing #16962 changes to 2.10.1? If so, just copy and paste
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] tisonkun commented on issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
tisonkun commented on issue #16919:
URL: https://github.com/apache/pulsar/issues/16919#issuecomment-1209081823
@lhotari do you mean that we should cherry-pick (to master) this change to other versioned docs?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [pulsar] Anonymitaet commented on issue #16919: [Security] [Doc] no advice on how to report vulnerabilities
Posted by GitBox <gi...@apache.org>.
Anonymitaet commented on issue #16919:
URL: https://github.com/apache/pulsar/issues/16919#issuecomment-1207558127
"How to report a Pulsar security issue" is documented in the [Contribution guide](https://pulsar.apache.org/community/#section-contribute).
<img width="1190" alt="image" src="https://user-images.githubusercontent.com/50226895/183322039-83d6c44b-2342-46cd-bb94-89963fe5be86.png">
<img width="1089" alt="image" src="https://user-images.githubusercontent.com/50226895/183322068-26d0950a-8129-4185-b8d3-45b8f2288848.png">
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@pulsar.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org