From 0d30313680cf2a1165060f6fcd13bbfc93fa17e1 Mon Sep 17 00:00:00 2001 From: Marta Rybczynska Date: Wed, 18 Oct 2023 07:22:41 +0200 Subject: SECURITY.md: add file Add a SECURITY.md file with hints for security researchers and other parties who might report potential security vulnerabilities. (From OE-Core rev: 4895e1892a49417fc5a806bd02c1bbac01f37253) Signed-off-by: Marta Rybczynska Signed-off-by: Richard Purdie --- SECURITY.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000..1b63da4f69 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,22 @@ +How to Report a Potential Vulnerability? +======================================== + +If you would like to report a public issue (for example, one with a released +CVE number), please report it using the +[https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Security Security Bugzilla] + +If you are dealing with a not-yet released or urgent issue, please send a +message to security AT yoctoproject DOT org, including as many details as +possible: the layer or software module affected, the recipe and its version, +and any example code, if available. + +Branches maintained with security fixes +--------------------------------------- + +See [https://wiki.yoctoproject.org/wiki/Stable_Release_and_LTS Stable release and LTS] +for detailed info regarding the policies and maintenance of Stable branches. + +The [https://wiki.yoctoproject.org/wiki/Releases Release page] contains a list of all +releases of the Yocto Project. Versions in grey are no longer actively maintained with +security patches, but well-tested patches may still be accepted for them for +significant issues. -- cgit v1.2.3-54-g00ecf