1# The OpenBMC security vulnerability reporting process
2
3This describes the OpenBMC security vulnerability reporting process which is
4intended to give the project time to address security problems before public
5disclosure.
6
7The main pieces are:
8
9- a procedure to privately report security vulnerabilities
10- a security response team to address reported vulnerabilities
11- the openbmc-security email address for the response team
12- guidelines for security response team members
13
14The basic workflow is:
15
161.  A community member reports a problem privately to the security response team
17    (and to the repository maintainers if known).
182.  The responders (including the security response team, the repository
19    maintainers, and the problem submitter) work to understand the problem.
203.  The repository maintainer creates an OpenBMC security advisory which
21    explains the problem, its severity, and how to protect your systems that
22    were built on OpenBMC.
234.  The responders privately engage community members to create workarounds and
24    fixes and to negotiate disclosure dates.
255.  The OpenBMC security advisory is published along with any accompanying CVEs.
26
27Note that the OpenBMC security response team is distinct from the OpenBMC
28security working group which remains completely open.
29
30The
31[How to privately report a security vulnerability](./how-to-report-a-security-vulnerability.md)
32web page explains how OpenBMC community members can report a security
33vulnerability and get a fix for it before public announcement of the
34vulnerability.
35
36The `openbmc-security at lists.ozlabs.org` email address is the primary
37communication vehicle between the person who reported the problem and the
38security response team, and the initial communication between the security
39response team members.
40
41The
42[Guidelines for security response team members](./obmc-security-response-team-guidelines.md)
43contain collected wisdom for the response team and community members who are
44working to fix the problem.
45