crypt/wolfssl
1
0
Fork 0
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-10-24 04:09:07 +03:00
Code Activity

Move Related Work Check from section 12 to section 8 in report template

Browse Source 
Related Work Check is a triage prerequisite and belongs with the other
due-diligence sections, not at the end after disclosure coordination.
Previous sections 8-11 shift to 9-12. Content unchanged; no internal
cross-references point to the shifted sections.
This commit is contained in:
Colton Willey
2026-04-22 19:07:36 -07:00
parent c6837a96c5
commit d5038f1a43
1 changed files with 45 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

90
SECURITY-REPORT-TEMPLATE.md
View File

@@ -160,51 +160,7 @@ The following are not proofs-of-concept and will not satisfy this requirement:
---
## 8. Caller API Usage
**Does triggering the defect require the caller to use wolfSSL APIs outside
their documented behavior?** _required_: answer yes or no, then describe the
specific API calls, options, and sequences used.
---
## 9. Severity Self-Assessment
**Reporter-proposed severity** _required_: Critical, High, Medium, or Low.
**CVSS 3.1 vector string** _optional_: e.g., `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`.
**Justification** _required_: in two to three sentences, map the severity to
the realistic attacker model and impact described above.
wolfSSL performs its own severity assessment per the published rubric. Your
assessment is input, not the final classification.
---
## 10. Disclosure Coordination
**Requested embargo period** _required_: state your preferred embargo
duration. Longer embargoes for ecosystem coordination may be requested.
**Downstream coordination** _required_: identify any downstream integrators,
certification bodies, or other parties whose involvement affects disclosure
timing.
**Public disclosure plans** _required_: describe any planned blog post,
conference talk, paper, or other public disclosure, with tentative timing,
so we can coordinate the advisory release.
---
## 11. Suggested Fix _(optional)_
If you have a proposed patch, attach it. Patches are not required, but they
accelerate the fix timeline.
---
## 12. Related Work Check
## 8. Related Work Check
**Have you verified this defect is not already being addressed?** _required_:
describe your review of open pull requests and recent commits in the
@@ -223,6 +179,50 @@ duplicates and do not receive CVE consideration.
---
## 9. Caller API Usage
**Does triggering the defect require the caller to use wolfSSL APIs outside
their documented behavior?** _required_: answer yes or no, then describe the
specific API calls, options, and sequences used.
---
## 10. Severity Self-Assessment
**Reporter-proposed severity** _required_: Critical, High, Medium, or Low.
**CVSS 3.1 vector string** _optional_: e.g., `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`.
**Justification** _required_: in two to three sentences, map the severity to
the realistic attacker model and impact described above.
wolfSSL performs its own severity assessment per the published rubric. Your
assessment is input, not the final classification.
---
## 11. Disclosure Coordination
**Requested embargo period** _required_: state your preferred embargo
duration. Longer embargoes for ecosystem coordination may be requested.
**Downstream coordination** _required_: identify any downstream integrators,
certification bodies, or other parties whose involvement affects disclosure
timing.
**Public disclosure plans** _required_: describe any planned blog post,
conference talk, paper, or other public disclosure, with tentative timing,
so we can coordinate the advisory release.
---
## 12. Suggested Fix _(optional)_
If you have a proposed patch, attach it. Patches are not required, but they
accelerate the fix timeline.
---
## What Happens Next
1. **Acknowledgment.** We acknowledge receipt as reports arrive.