2014-07-04 02:32:52 +00:00
|
|
|
.. _disclosure:
|
|
|
|
|
|
|
|
|
|
==========================
|
|
|
|
|
Security disclosure policy
|
|
|
|
|
==========================
|
|
|
|
|
|
|
|
|
|
:email: security@saltstack.com
|
|
|
|
|
:gpg key ID: 4EA0793D
|
|
|
|
|
:gpg key fingerprint: ``8ABE 4EFC F0F4 B24B FF2A AF90 D570 F2D3 4EA0 793D``
|
2014-09-17 23:00:18 +00:00
|
|
|
|
|
|
|
|
**gpg public key:**
|
2014-07-07 20:39:07 +00:00
|
|
|
|
|
|
|
|
.. code-block:: text
|
|
|
|
|
|
2014-08-11 18:08:19 +00:00
|
|
|
-----BEGIN PGP PUBLIC KEY BLOCK-----
|
2014-07-07 20:39:07 +00:00
|
|
|
Version: GnuPG/MacGPG2 v2.0.22 (Darwin)
|
|
|
|
|
|
|
|
|
|
mQINBFO15mMBEADa3CfQwk5ED9wAQ8fFDku277CegG3U1hVGdcxqKNvucblwoKCb
|
|
|
|
|
hRK6u9ihgaO9V9duV2glwgjytiBI/z6lyWqdaD37YXG/gTL+9Md+qdSDeaOa/9eg
|
|
|
|
|
7y+g4P+FvU9HWUlujRVlofUn5Dj/IZgUywbxwEybutuzvvFVTzsn+DFVwTH34Qoh
|
|
|
|
|
QIuNzQCSEz3Lhh8zq9LqkNy91ZZQO1ZIUrypafspH6GBHHcE8msBFgYiNBnVcUFH
|
|
|
|
|
u0r4j1Rav+621EtD5GZsOt05+NJI8pkaC/dDKjURcuiV6bhmeSpNzLaXUhwx6f29
|
|
|
|
|
Vhag5JhVGGNQxlRTxNEM86HEFp+4zJQ8m/wRDrGX5IAHsdESdhP+ljDVlAAX/ttP
|
|
|
|
|
/Ucl2fgpTnDKVHOA00E515Q87ZHv6awJ3GL1veqi8zfsLaag7rw1TuuHyGLOPkDt
|
|
|
|
|
t5PAjsS9R3KI7pGnhqI6bTOi591odUdgzUhZChWUUX1VStiIDi2jCvyoOOLMOGS5
|
|
|
|
|
AEYXuWYP7KgujZCDRaTNqRDdgPd93Mh9JI8UmkzXDUgijdzVpzPjYgFaWtyK8lsc
|
|
|
|
|
Fizqe3/Yzf9RCVX/lmRbiEH+ql/zSxcWlBQd17PKaL+TisQFXcmQzccYgAxFbj2r
|
|
|
|
|
QHp5ABEu9YjFme2Jzun7Mv9V4qo3JF5dmnUk31yupZeAOGZkirIsaWC3hwARAQAB
|
|
|
|
|
tDBTYWx0U3RhY2sgU2VjdXJpdHkgVGVhbSA8c2VjdXJpdHlAc2FsdHN0YWNrLmNv
|
|
|
|
|
bT6JAj4EEwECACgFAlO15mMCGwMFCQeGH4AGCwkIBwMCBhUIAgkKCwQWAgMBAh4B
|
|
|
|
|
AheAAAoJENVw8tNOoHk9z/MP/2vzY27fmVxU5X8joiiturjlgEqQw41IYEmWv1Bw
|
|
|
|
|
4WVXYCHP1yu/1MC1uuvOmOd5BlI8YO2C2oyW7d1B0NorguPtz55b7jabCElekVCh
|
|
|
|
|
h/H4ZVThiwqgPpthRv/2npXjIm7SLSs/kuaXo6Qy2JpszwDVFw+xCRVL0tH9KJxz
|
|
|
|
|
HuNBeVq7abWD5fzIWkmGM9hicG/R2D0RIlco1Q0VNKy8klG+pOFOW886KnwkSPc7
|
|
|
|
|
JUYp1oUlHsSlhTmkLEG54cyVzrTP/XuZuyMTdtyTc3mfgW0adneAL6MARtC5UB/h
|
|
|
|
|
q+v9dqMf4iD3wY6ctu8KWE8Vo5MUEsNNO9EA2dUR88LwFZ3ZnnXdQkizgR/Aa515
|
|
|
|
|
dm17vlNkSoomYCo84eN7GOTfxWcq+iXYSWcKWT4X+h/ra+LmNndQWQBRebVUtbKE
|
|
|
|
|
ZDwKmiQz/5LY5EhlWcuU4lVmMSFpWXt5FR/PtzgTdZAo9QKkBjcv97LYbXvsPI69
|
|
|
|
|
El1BLAg+m+1UpE1L7zJT1il6PqVyEFAWBxW46wXCCkGssFsvz2yRp0PDX8A6u4yq
|
|
|
|
|
rTkt09uYht1is61joLDJ/kq3+6k8gJWkDOW+2NMrmf+/qcdYCMYXmrtOpg/wF27W
|
|
|
|
|
GMNAkbdyzgeX/MbUBCGCMdzhevRuivOI5bu4vT5s3KdshG+yhzV45bapKRd5VN+1
|
|
|
|
|
mZRquQINBFO15mMBEAC5UuLii9ZLz6qHfIJp35IOW9U8SOf7QFhzXR7NZ3DmJsd3
|
|
|
|
|
f6Nb/habQFIHjm3K9wbpj+FvaW2oWRlFVvYdzjUq6c82GUUjW1dnqgUvFwdmM835
|
|
|
|
|
1n0YQ2TonmyaF882RvsRZrbJ65uvy7SQxlouXaAYOdqwLsPxBEOyOnMPSktW5V2U
|
|
|
|
|
IWyxsNP3sADchWIGq9p5D3Y/loyIMsS1dj+TjoQZOKSj7CuRT98+8yhGAY8YBEXu
|
|
|
|
|
9r3I9o6mDkuPpAljuMc8r09Im6az2egtK/szKt4Hy1bpSSBZU4W/XR7XwQNywmb3
|
|
|
|
|
wxjmYT6Od3Mwj0jtzc3gQiH8hcEy3+BO+NNmyzFVyIwOLziwjmEcw62S57wYKUVn
|
|
|
|
|
HD2nglMsQa8Ve0e6ABBMEY7zGEGStva59rfgeh0jUMJiccGiUDTMs0tdkC6knYKb
|
|
|
|
|
u/fdRqNYFoNuDcSeLEw4DdCuP01l2W4yY+fiK6hAcL25amjzc+yYo9eaaqTn6RAT
|
|
|
|
|
bzdhHQZdpAMxY+vNT0+NhP1Zo5gYBMR65Zp/VhFsf67ijb03FUtdw9N8dHwiR2m8
|
|
|
|
|
vVA8kO/gCD6wS2p9RdXqrJ9JhnHYWjiVuXR+f755ZAndyQfRtowMdQIoiXuJEXYw
|
|
|
|
|
6XN+/BX81gJaynJYc0uw0MnxWQX+A5m8HqEsbIFUXBYXPgbwXTm7c4IHGgXXdwAR
|
|
|
|
|
AQABiQIlBBgBAgAPBQJTteZjAhsMBQkHhh+AAAoJENVw8tNOoHk91rcQAIhxLv4g
|
|
|
|
|
duF/J1Cyf6Wixz4rqslBQ7DgNztdIUMjCThg3eB6pvIzY5d3DNROmwU5JvGP1rEw
|
|
|
|
|
hNiJhgBDFaB0J/y28uSci+orhKDTHb/cn30IxfuAuqrv9dujvmlgM7JUswOtLZhs
|
|
|
|
|
5FYGa6v1RORRWhUx2PQsF6ORg22QAaagc7OlaO3BXBoiE/FWsnEQCUsc7GnnPqi7
|
|
|
|
|
um45OJl/pJntsBUKvivEU20fj7j1UpjmeWz56NcjXoKtEvGh99gM5W2nSMLE3aPw
|
|
|
|
|
vcKhS4yRyLjOe19NfYbtID8m8oshUDji0XjQ1z5NdGcf2V1YNGHU5xyK6zwyGxgV
|
|
|
|
|
xZqaWnbhDTu1UnYBna8BiUobkuqclb4T9k2WjbrUSmTwKixokCOirFDZvqISkgmN
|
|
|
|
|
r6/g3w2TRi11/LtbUciF0FN2pd7rj5mWrOBPEFYJmrB6SQeswWNhr5RIsXrQd/Ho
|
|
|
|
|
zvNm0HnUNEe6w5YBfA6sXQy8B0Zs6pcgLogkFB15TuHIIIpxIsVRv5z8SlEnB7HQ
|
|
|
|
|
Io9hZT58yjhekJuzVQB9loU0C/W0lzci/pXTt6fd9puYQe1DG37pSifRG6kfHxrR
|
|
|
|
|
if6nRyrfdTlawqbqdkoqFDmEybAM9/hv3BqriGahGGH/hgplNQbYoXfNwYMYaHuB
|
|
|
|
|
aSkJvrOQW8bpuAzgVyd7TyNFv+t1kLlfaRYJ
|
|
|
|
|
=wBTJ
|
|
|
|
|
-----END PGP PUBLIC KEY BLOCK-----
|
2014-07-04 02:32:52 +00:00
|
|
|
|
|
|
|
|
The SaltStack Security Team is available at security@saltstack.com for
|
|
|
|
|
security-related bug reports or questions.
|
|
|
|
|
|
|
|
|
|
We request the disclosure of any security-related bugs or issues be reported
|
|
|
|
|
non-publicly until such time as the issue can be resolved and a security-fix
|
|
|
|
|
release can be prepared. At that time we will release the fix and make a public
|
|
|
|
|
announcement with upgrade instructions and download locations.
|
|
|
|
|
|
2014-08-06 15:22:25 +00:00
|
|
|
Security response procedure
|
2014-09-17 23:00:18 +00:00
|
|
|
===========================
|
2014-07-04 02:32:52 +00:00
|
|
|
|
|
|
|
|
SaltStack takes security and the trust of our customers and users very
|
|
|
|
|
seriously. Our disclosure policy is intended to resolve security issues as
|
|
|
|
|
quickly and safely as is possible.
|
|
|
|
|
|
|
|
|
|
1. A security report sent to security@saltstack.com is assigned to a team
|
|
|
|
|
member. This person is the primary contact for questions and will
|
|
|
|
|
coordinate the fix, release, and announcement.
|
|
|
|
|
|
|
|
|
|
2. The reported issue is reproduced and confirmed. A list of affected projects
|
|
|
|
|
and releases is made.
|
|
|
|
|
|
|
|
|
|
3. Fixes are implemented for all affected projects and releases that are
|
|
|
|
|
actively supported. Back-ports of the fix are made to any old releases that
|
|
|
|
|
are actively supported.
|
|
|
|
|
|
2014-07-14 20:54:36 +00:00
|
|
|
4. Packagers are notified via the `salt-packagers`_ mailing list that an issue
|
2014-07-04 02:32:52 +00:00
|
|
|
was reported and resolved, and that an announcement is incoming.
|
|
|
|
|
|
|
|
|
|
5. A new release is created and pushed to all affected repositories. The
|
|
|
|
|
release documentation provides a full description of the issue, plus any
|
|
|
|
|
upgrade instructions or other relevant details.
|
|
|
|
|
|
2014-07-14 20:54:36 +00:00
|
|
|
6. An announcement is made to the `salt-users`_ and `salt-announce`_ mailing
|
2014-07-04 02:32:52 +00:00
|
|
|
lists. The announcement contains a description of the issue and a link to
|
|
|
|
|
the full release documentation and download locations.
|
|
|
|
|
|
2015-04-10 10:21:20 +00:00
|
|
|
Receiving security announcements
|
2015-05-16 23:24:04 +00:00
|
|
|
================================
|
2014-07-04 02:32:52 +00:00
|
|
|
|
2014-07-14 20:54:36 +00:00
|
|
|
The fastest place to receive security announcements is via the `salt-announce`_
|
2015-05-16 23:24:04 +00:00
|
|
|
mailing list. This list is low-traffic.
|
