Skip to content

Commit 22652b4

Browse files
julieqiujulieqiu
committed
_content: update security policy
The golang.org/security page is updated according to the new security policy. Fixes golang/go#44918 Change-Id: I66306aa0368ee12f89f68f97a2ae1412d98da628 Reviewed-on: https://go-review.googlesource.com/c/website/+/352029 Trust: Julie Qiu <[email protected]> Trust: Katie Hockman <[email protected]> Run-TryBot: Julie Qiu <[email protected]> TryBot-Result: Go Bot <[email protected]> Reviewed-by: Katie Hockman <[email protected]>
1 parent 6063efb commit 22652b4

File tree

1 file changed

+188
-143
lines changed

1 file changed

+188
-143
lines changed

‎_content/security.html

Lines changed: 188 additions & 143 deletions
Original file line numberDiff line numberDiff line change
@@ -2,180 +2,225 @@
22
"Title": "Go Security Policy"
33
}-->
44

5-
<h2>Implementation</h2>
5+
<h2>Overview</h2>
66

7-
<h3>Reporting a Security Bug</h3>
7+
<p>
8+
This document explains the Go Security team's process for handling issues
9+
reported and what to expect in return.
10+
</p>
11+
12+
<h2>Reporting a Security Bug</h2>
13+
14+
<p>
15+
All security bugs in the Go distribution should be reported by email to
16+
<a href="mailto:[email protected]">[email protected]</a>. This mail is
17+
delivered to the Go Security team.
18+
</p>
19+
20+
<p>
21+
To ensure your report is not marked as spam,
22+
<strong>please include the word "vulnerability"</strong> anywhere in your
23+
email. Please use a descriptive subject line for your report email.
24+
</p>
825

926
<p>
10-
Please report to us any issues you find.
11-
This document explains how to do that and what to expect in return.
27+
Your email will be acknowledged within 7 days, and you'll be kept up to date
28+
with the progress until resolution. Your issue will be fixed or made public
29+
within 90 days. If you have not received a reply to your email within 7 days,
30+
please follow up with the Go security team directly at
31+
<a href="mailto:[email protected]">[email protected]</a>.
1232
</p>
1333

34+
<h2>Tracks</h2>
35+
1436
<p>
15-
All security bugs in the Go distribution should be reported by email to
16-
<a href="mailto:[email protected]">[email protected]</a>.
17-
This mail is delivered to a small security team.
18-
Your email will be acknowledged within 24 hours, and you'll receive a more
19-
detailed response to your email within 72 hours indicating the next steps in
20-
handling your report.
37+
Depending on the nature of your issue, it will be categorized by the Go
38+
security team as an issue in the PUBLIC, PRIVATE, or URGENT track. All
39+
security issues will be issued CVE numbers.
2140
</p>
2241

42+
<h3>PUBLIC</h3>
43+
<p>
44+
Issues in the PUBLIC track affect niche configurations, have very limited
45+
impact, or are already widely known.
46+
</p>
47+
48+
<p>
49+
PUBLIC track issues are <strong>fixed in public</strong>, and get backported
50+
to the next scheduled
51+
<a href="https://golang.org/wiki/MinorReleases">minor releases</a>
52+
(which occur ~monthly). The release announcement includes details of these
53+
issues, but there is no pre-announcement.
54+
</p>
55+
56+
<p>Examples of past PUBLIC issues include:</p>
57+
<ul>
58+
<li>
59+
<a href="https://golang.org/issue/44916">#44916</a>:
60+
archive/zip: can panic when calling Reader.Open
61+
</li>
62+
<li>
63+
<a href="https://golang.org/issue/44913">#44913</a>:
64+
encoding/xml: infinite loop when using xml.NewTokenDecoder with a custom
65+
TokenReader
66+
</li>
67+
<li>
68+
<a href="https://golang.org/issue/43786">#43786</a>:
69+
encoding/xml: infinite crypto/elliptic: incorrect operations on the P-224
70+
curve
71+
</li>
72+
<li>
73+
<a href="https://golang.org/issue/40928">#40928</a>:
74+
net/http/cgi,net/http/fcgi: Cross-Site Scripting (XSS) when Content-Type is
75+
not specified
76+
</li>
77+
<li>
78+
<a href="https://golang.org/issue/40618">#40618</a>:
79+
encoding/binary: ReadUvarint and ReadVarint can read an unlimited number of
80+
bytes from invalid inputs
81+
</li>
82+
<li>
83+
<a href="https://golang.org/issue/36834">#36834</a>:
84+
crypto/x509: certificate validation bypass on Windows 10
85+
</li>
86+
</ul>
87+
88+
<h3>PRIVATE</h3>
89+
2390
<p>
24-
To ensure your report is not marked as spam, please include the word "vulnerability"
25-
anywhere in your email. Please use a descriptive subject line for your report email.
91+
Issues in the PRIVATE track are violations of committed security properties.
2692
</p>
2793

2894
<p>
29-
After the initial reply to your report, the security team will endeavor to keep
30-
you informed of the progress being made towards a fix and full announcement.
31-
These updates will be sent at least every five days.
32-
In reality, this is more likely to be every 24-48 hours.
95+
PRIVATE track issues are
96+
<strong>fixed in the next scheduled
97+
<a href="https://golang.org/wiki/MinorReleases">minor releases</a>
98+
</strong>,
99+
and are kept private until then.
33100
</p>
34101

35102
<p>
36-
If you have not received a reply to your email within 48 hours or you have not
37-
heard from the security team for the past five days please contact the Go
38-
security team directly:
103+
Three to seven days before the release, a pre-announcement is sent to
104+
golang-announce, announcing the presence of a security fix in the upcoming
105+
releases, and whether the issue affects the standard library, the toolchain,
106+
or both (but not disclosing any more details).
39107
</p>
40108

109+
<p>Some examples of past PRIVATE issues include:</p>
41110
<ul>
42-
<li>Primary security coordinator: <a href="mailto:[email protected]">Filippo Valsorda</a>.</li>
43-
<li>Secondary coordinator: <a href="mailto:[email protected]">Adam Langley</a>.</li>
44-
<li>If you receive no response, mail <a href="mailto:[email protected]">[email protected]</a> or use the <a href="https://groups.google.com/forum/#!forum/golang-dev">golang-dev web interface</a>.</li>
111+
<li>
112+
<a href="https://golang.org/issue/42552">#42552</a>:
113+
math/big: panic during recursive division of very large numbers
114+
</li>
115+
<li>
116+
<a href="https://golang.org/issue/34902">#34902</a>:
117+
net/http: Expect 100-continue panics in httputil.ReverseProxy
118+
</li>
119+
<li>
120+
<a href="https://golang.org/issue/39360">#39360</a>:
121+
crypto/x509: Certificate.Verify method seemingly ignoring EKU requirements
122+
on Windows
123+
</li>
124+
<li>
125+
<a href="https://golang.org/issue/34960">#34960</a>:
126+
crypto/dsa: invalid public key causes panic in dsa.Verify
127+
</li>
128+
<li>
129+
<a href="https://golang.org/issue/34540">#34540</a>:
130+
net/http: invalid headers are normalized, allowing request smuggling
131+
</li>
132+
<li>
133+
<a href="https://golang.org/issue/29098">#29098</a>:
134+
net/url: URL.Parse Multiple Parsing Issues
135+
</li>
45136
</ul>
46137

138+
<h3>URGENT</h3>
139+
47140
<p>
48-
Please note that golang-dev is a public discussion forum.
49-
When escalating on this list, please do not disclose the details of the issue.
50-
Simply state that you're trying to reach a member of the security team.
141+
URGENT track issues are a threat to the Go ecosystem’s integrity, or are being
142+
actively exploited in the wild leading to severe damage. There are no recent
143+
examples, but they would include remote code execution in net/http, or
144+
practical key recovery in crypto/tls.
51145
</p>
52146

53-
<h3>Flagging Existing Issues as Security-related</h3>
147+
<p>
148+
URGENT track issues are fixed in private, and
149+
<strong>trigger an immediate dedicated security release</strong>, possibly
150+
with no pre-announcement.
151+
</p>
152+
153+
<h2>Flagging Existing Issues as Security-related</h2>
54154

55155
<p>
56-
If you believe that an <a href="https://golang.org/issue">existing issue</a>
57-
is security-related, we ask that you send an email to
58-
<a href="mailto:[email protected]">[email protected]</a>.
59-
The email should include the issue ID and a short description of why it should
60-
be handled according to this security policy.
156+
If you believe that an <a href="https://golang.org/issue">existing issue</a>
157+
is security-related, we ask that you send an email to
158+
<a href="mailto:[email protected]">[email protected]</a>. The email should
159+
include the issue ID and a short description of why it should be handled
160+
according to this security policy.
61161
</p>
62162

63-
<h3>Disclosure Process</h3>
163+
<h2>Disclosure Process</h2>
64164

65165
<p>The Go project uses the following disclosure process:</p>
66166

67167
<ol>
68-
<li>Once the security report is received it is assigned a primary handler.
69-
This person coordinates the fix and release process.</li>
70-
<li>The issue is confirmed and a list of affected software is determined.</li>
71-
<li>Code is audited to find any potential similar problems.</li>
72-
<li>If it is determined, in consultation with the submitter, that a CVE-ID is
73-
required, the primary handler obtains one via email to
74-
<a href="https://oss-security.openwall.org/wiki/mailing-lists/distros">oss-distros</a>.</li>
75-
<li>Fixes are prepared for the two most recent major releases and the head/master
76-
revision. These fixes are not yet committed to the public repository.</li>
77-
<li>A notification is sent to the
78-
<a href="https://groups.google.com/group/golang-announce">golang-announce</a>
79-
mailing list to give users time to prepare their systems for the update.</li>
80-
<li>Three working days following this notification, the fixes are applied to
81-
the <a href="https://go.googlesource.com/go">public repository</a> and a new
82-
Go release is issued.</li>
83-
<li>On the date that the fixes are applied, announcements are sent to
84-
<a href="https://groups.google.com/group/golang-announce">golang-announce</a>,
85-
<a href="https://groups.google.com/group/golang-dev">golang-dev</a>, and
86-
<a href="https://groups.google.com/group/golang-nuts">golang-nuts</a>.
168+
<li>
169+
Once the security report is received it is assigned a primary handler. This
170+
person coordinates the fix and release process.
171+
</li>
172+
<li>The issue is confirmed and a list of affected software is determined.</li>
173+
<li>Code is audited to find any potential similar problems.</li>
174+
<li>
175+
If it is determined, in consultation with the submitter, that a CVE number is
176+
required, the primary handler will obtain one.
177+
</li>
178+
<li>
179+
Fixes are prepared for the two most recent major releases and the
180+
head/master revision. Fixes are prepared for the two most recent major
181+
releases and merged to head/master.
182+
</li>
183+
<li>
184+
On the date that the fixes are applied, announcements are sent to
185+
<a href="https://groups.google.com/group/golang-announce">golang-announce</a>,
186+
<a href="https://groups.google.com/group/golang-dev">golang-dev</a>, and
187+
<a href="https://groups.google.com/group/golang-nuts">golang-nuts</a>.
188+
</li>
87189
</ol>
88190

89191
<p>
90-
This process can take some time, especially when coordination is required with
91-
maintainers of other projects. Every effort will be made to handle the bug in
92-
as timely a manner as possible, however it's important that we follow the
93-
process described above to ensure that disclosures are handled consistently.
94-
</p>
95-
96-
<p>
97-
For security issues that include the assignment of a CVE-ID,
98-
the issue is listed publicly under the
99-
<a href="https://www.cvedetails.com/vulnerability-list/vendor_id-14185/Golang.html">"Golang" product on the CVEDetails website</a>
100-
as well as the
101-
<a href="https://web.nvd.nist.gov/view/vuln/search">National Vulnerability Disclosure site</a>.
102-
</p>
103-
104-
<h3>Receiving Security Updates</h3>
105-
106-
<p>
107-
The best way to receive security announcements is to subscribe to the
108-
<a href="https://groups.google.com/forum/#!forum/golang-announce">golang-announce</a>
109-
mailing list. Any messages pertaining to a security issue will be prefixed
110-
with <code>[security]</code>.
111-
</p>
112-
113-
<h3>Comments on This Policy</h3>
114-
115-
<p>
116-
If you have any suggestions to improve this policy, please send an email to
117-
<a href="mailto:[email protected]">[email protected]</a> for discussion.
118-
</p>
119-
120-
<h3>PGP Key for <a href="mailto:[email protected]">[email protected]</a></h3>
121-
122-
<p>
123-
We accept PGP-encrypted email, but the majority of the security team
124-
are not regular PGP users so it's somewhat inconvenient. Please only
125-
use PGP for critical security reports.
126-
</p>
127-
128-
<pre>
129-
-----BEGIN PGP PUBLIC KEY BLOCK-----
130-
131-
mQINBFXI1h0BEADZdm05GDFWvjmQKutUVb0cJKS+VR+6XU3g/YQZGC8tnIL6i7te
132-
+fPJHfQc2uIw0xeBgZX4Ni/S8yIqsbIjqYeaToX7QFUufJDQwrmlQRDVAvvT5HBT
133-
J80JEs7yHRreFoLzB6dnWehWXzWle4gFKeIy+hvLrYquZVvbeEYTnX7fNzZg0+5L
134-
ksvj7lnQlJIy1l3sL/7uPr9qsm45/hzd0WjTQS85Ry6Na3tMwRpqGENDh25Blz75
135-
8JgK9JmtTJa00my1zzeCXU04CKKEMRbkMLozzudOH4ZLiLWcFiKRpeCn860wC8l3
136-
oJcyyObuTSbr9o05ra3On+epjCEFkknGX1WxPv+TV34i0a23AtuVyTCloKb7RYXc
137-
7mUaskZpU2rFBqIkzZ4MQJ7RDtGlm5oBy36j2QL63jAZ1cKoT/yvjJNp2ObmWaVF
138-
X3tk/nYw2H0YDjTkTCgGtyAOj3Cfqrtsa5L0jG5K2p4RY8mtVgQ5EOh7QxuS+rmN
139-
JiA39SWh7O6uFCwkz/OCXzqeh6/nP10HAb9S9IC34QQxm7Fhd0ZXzEv9IlBTIRzk
140-
xddSdACPnLE1gJcFHxBd2LTqS/lmAFShCsf8S252kagKJfHRebQJZHCIs6kT9PfE
141-
0muq6KRKeDXv01afAUvoB4QW/3chUrtgL2HryyO8ugMu7leVGmoZhFkIrQARAQAB
142-
tCZHbyBTZWN1cml0eSBUZWFtIDxzZWN1cml0eUBnb2xhbmcub3JnPokCTgQTAQoA
143-
OAIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgBYhBGROHzjvGgTlE7xbTTpG0ZF5
144-
Wlg4BQJd8rfQAAoJEDpG0ZF5Wlg4198P/2YDcEwEqWBWjriLFXdTGOcVxQ7AC/mX
145-
Fe576zwgmrbqO00IaHOOqZZYXKd078FZyg2qQKILvfSAQB7EtLwfPEgv3Wca/Jb/
146-
ma2hNz+AveiWDVuF4yPx8qvFer/6Yzv9+anfpUP//qfo/7L3VSYKwNAcqqNGvBMh
147-
fLb7oWDSkdRmcu57c4WYv8i5BtxMRXs581r836bG3U0z0WQG8j64RpYp6sipqJnv
148-
09l3R5SXd7kkS26ntLU4fgTNJ6Eim7YoXsqLtVe4VZHGYz3D0yHnvCBpbJa2WpP2
149-
QT6TtFizvKtQlC0k1uo88VV8DyRdp2V6BO9cSNecvXZh81H0SjtD9MwdMnpX3shT
150-
LKu3L6wlJtb/EJVZg6+usJo0VunUdNTiBmy4FJrko7YYOSVHKKBA6dooufGNUSjw
151-
9Tieqh4jnzpg6+aIrNugZIrABH2G0GD/SvUSfjli0i+D1mqQSsMcLzE1BBcichpS
152-
htjv6fU8nI5XXmloUn1P2WBwziemsb7YcfBLNVeCxlAmoJn1hnOPjNzmKfVZk95E
153-
VJNvVB76JCh+S/0bAba5+nBZ1HRn/FAbs9vfUpp1sOFf25jX9bDAZvkqwgyPpNv/
154-
jONK0zNXRD5AfKdCA1nkMI70NNS5oBxPowp95eKyuw4hCINvfuPq5sLJa3cIMj3M
155-
MVO91QDs9eXxuQINBFXI1h0BEACXD0f/XJtCzgrdcoDWOggjXqu1r0pLt7Dvr5qB
156-
ejSN5JHAwRB8i07Fi9+Gajz7J2flNaxNuJ8ZTwvf4QFMxFHLNaFtoY7RaLPDsFNU
157-
nufklb6d0+txSmn+KVSToBRXFo7/z9H735Ulmmh6gsddiWgUY25fnwYsjLWNIG8u
158-
wuX8qLkg6se8PUYrpN+06XmPwg8LUtIGvAYk7zTfHvBR1A/+2wo39A9HymcGe2sS
159-
CtAVIj5DeqsK9UyZecGVi6aN84G3ykoyAH3+LH4dY3ymJA1CInEP5eMQzpfBSZCo
160-
hHvLkYg0paC6d0Ka1gjNWBj2nYGvpQ+tMmLXYt8q/mzZHo2fEUe/9p3b0Kk9N4sl
161-
GxKoV+oEv3r0EKmP+KxeZASbgW3OJmJ0BFejXYqIYCc8X2i2Ks0enj7yHA0Hexx/
162-
twjnfLydmK871zAjsGgKVjpkhpuMNwnGMr7bh6ajPeYnlIelmlAtJv2jwZsst9c6
163-
r7i7MRfYDfR+Gu2xBv/HQYzi/cRTVo/aaO6SzJhuCV21jri0PfnCoAD2ZWXlTH6D
164-
UehQG8vDSH6XPCHfvQ0nD/8hO8FBVS0MwH3qt8g/h8vmliXmmZHP6+y4nSJfObTm
165-
oGAp9Ko7tOj1JbFA91fz1Hi7T9dUCXDQCT1lx6rdb3q+x4RRNHdqhkIwg+LB9wNq
166-
rrStZQARAQABiQI2BBgBCgAgAhsMFiEEZE4fOO8aBOUTvFtNOkbRkXlaWDgFAl3y
167-
uFYACgkQOkbRkXlaWDiMgw//YvO2nZxWNSnQxqCEi8RXHV/3qsDDe8LloviFFV/M
168-
GSiGZBOhLJ0bFm9aKKPoye5mrZXBKvEVPu0h1zn43+lZruhARPiTu2AecQ7fstET
169-
PyXMZJ4mfLSFIaAumuH9dQEQJA9RRaFK8uzPRgAxVKyuNYS89psz/RvSeRM3B7Li
170-
m9waLs42+5xtltR5F6HKPhrgS/rrFHKMrNiDNMMG2FYu1TjonA9QnzAxDPixH3A1
171-
VNEj6tVqVK8wCMpci3YaXZJntX0H3oO6qloL8qIpSMVrIiD4IDBDK13Jn3OJ7veq
172-
iDn1mbGFYtfu8R+QV2xeDSJ6nEKfV3Mc3PFDbJMdzkOCdvExC8qsuUOqO4J6dRt7
173-
9NVptL0xZqlBjpF9fq9XCt7ZcQLDqbUF/rUs58yKSqEGrruXTx4cTLtwkTLcqJOw
174-
/CSgFtE8cvY51uupuEFzfmt8JLNTxsm2X2NlsZYxFJhamVrGFroa55nqgKe3tF7e
175-
AQBU641SZRYloqGgPK+4PB79vV4RyEDETOpD3PvpN2IafVWDacI4LXW0a4EKnPUj
176-
7JwRBmZxESda3OixSONv/VcuEOyGAZUppbLM4XYTtslRIqdQJFr7Vkza/VIoUqaY
177-
MkFIioHf2QndVwDXt3d0b0aAGaLeMRD1MFGtLNigEDD45nPeEpuGzXkUATpVWGiV
178-
bIs=
179-
=Nx85
180-
-----END PGP PUBLIC KEY BLOCK-----
181-
</pre>
192+
This process can take some time, especially when coordination is required with
193+
maintainers of other projects. Every effort will be made to handle the bug in
194+
as timely a manner as possible, however it's important that we follow the
195+
process described above to ensure that disclosures are handled consistently.
196+
</p>
197+
198+
<p>
199+
For security issues that include the assignment of a CVE number, the issue is
200+
listed publicly under the
201+
<a href="https://www.cvedetails.com/vulnerability-list/vendor_id-14185/Golang.html">
202+
"Golang" product on the CVEDetails website
203+
</a>
204+
as well as the
205+
<a href="https://web.nvd.nist.gov/view/vuln/search">
206+
National Vulnerability Disclosure site
207+
</a>.
208+
</p>
209+
210+
<h2>Receiving Security Updates</h2>
211+
212+
<p>
213+
The best way to receive security announcements is to subscribe to the
214+
<a href="https://groups.google.com/forum/#!forum/golang-announce">
215+
golang-announce
216+
</a>
217+
mailing list. Any messages pertaining to a security issue will be prefixed
218+
with <code>[security]</code>.
219+
</p>
220+
221+
<h2>Comments on This Policy</h2>
222+
223+
<p>
224+
If you have any suggestions to improve this policy, please
225+
<a href="https://golang.org/issue/new">file an issue</a> for discussion.
226+
</p>

0 commit comments

Comments
 (0)