- Add templates for security advisories and errata notices to the
tree. - Link to the templates on the reporting.html page. Suggested by: emaste Discussed with: secteam (emaste, remko) Sponsored by: The FreeBSD Foundation
This commit is contained in:
Glen Barber
parent
fb6e880609
commit
9061a2e8c7
Notes:
svn2git
2020-12-08 03:00:23 +00:00
svn path=/head/; revision=52777
4 changed files with 289 additions and 0 deletions
|
|
@ -11,6 +11,8 @@ SUBDIR= advisories
|
||||||
SUBDIR+= patches
|
SUBDIR+= patches
|
||||||
|
|
||||||
DATA= so_public_key.asc
|
DATA= so_public_key.asc
|
||||||
|
DATA= advisory-template.txt
|
||||||
|
DATA= errata-template.txt
|
||||||
DOCS= charter.xml
|
DOCS= charter.xml
|
||||||
DOCS+= security.xml
|
DOCS+= security.xml
|
||||||
DOCS+= advisories.xml
|
DOCS+= advisories.xml
|
||||||
|
|
|
||||||
140
en_US.ISO8859-1/htdocs/security/advisory-template.txt
Normal file
140
en_US.ISO8859-1/htdocs/security/advisory-template.txt
Normal file
|
|
@ -0,0 +1,140 @@
|
||||||
|
=============================================================================
|
||||||
|
FreeBSD-SA-ADVISORY_TEMPLATE Security Advisory
|
||||||
|
The FreeBSD Project
|
||||||
|
|
||||||
|
Topic:
|
||||||
|
|
||||||
|
Category: < core | contrib >
|
||||||
|
Module: <module name>
|
||||||
|
Announced: 2019-XX-XX
|
||||||
|
Credits:
|
||||||
|
Affects: <affected versions>
|
||||||
|
<e.g., "All supported versions of FreeBSD.", "FreeBSD
|
||||||
|
12.0 and later.", "FreeBSD 12.x", or "FreeBSD 11.2">
|
||||||
|
Corrected: 2019-XX-XX XX:XX:XX UTC (stable/12, 12.0-STABLE)
|
||||||
|
2019-XX-XX XX:XX:XX UTC (releng/12.0, 12.0-RELEASE-pXX)
|
||||||
|
2019-XX-XX XX:XX:XX UTC (stable/11, 11.2-STABLE)
|
||||||
|
2019-XX-XX XX:XX:XX UTC (releng/11.2, 11.2-RELEASE-pXX)
|
||||||
|
CVE Name: CVE-XXXX-XXXX
|
||||||
|
|
||||||
|
For general information regarding FreeBSD Security Advisories,
|
||||||
|
including descriptions of the fields above, security branches, and the
|
||||||
|
following sections, please visit <URL:https://security.FreeBSD.org/>.
|
||||||
|
|
||||||
|
I. Background
|
||||||
|
|
||||||
|
<brief description of what the affected bits are supposed to do>
|
||||||
|
|
||||||
|
II. Problem Description
|
||||||
|
|
||||||
|
<detailed description of the problem>
|
||||||
|
|
||||||
|
III. Impact
|
||||||
|
|
||||||
|
<description as to why the above problem is bad>
|
||||||
|
|
||||||
|
IV. Workaround
|
||||||
|
|
||||||
|
<If no workaround exists:>
|
||||||
|
No workaround is available.
|
||||||
|
|
||||||
|
<... but some systems are unaffected:>
|
||||||
|
No workaround is available. <insert simple description of some
|
||||||
|
systems that are not vulnerable>
|
||||||
|
|
||||||
|
<If a workaround exists:>
|
||||||
|
<insert workaround here>
|
||||||
|
|
||||||
|
V. Solution
|
||||||
|
|
||||||
|
<insert solution here>
|
||||||
|
|
||||||
|
Perform one of the following:
|
||||||
|
|
||||||
|
1) Upgrade your vulnerable system to a supported FreeBSD stable or
|
||||||
|
release / security branch (releng) dated after the correction date.
|
||||||
|
[XX Needs reboot? Mention please]
|
||||||
|
|
||||||
|
2) To update your vulnerable system via a binary patch:
|
||||||
|
|
||||||
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
||||||
|
platforms can be updated via the freebsd-update(8) utility:
|
||||||
|
|
||||||
|
# freebsd-update fetch
|
||||||
|
# freebsd-update install
|
||||||
|
[XX Needs reboot? Mention please]
|
||||||
|
|
||||||
|
3) To update your vulnerable system via a source code patch:
|
||||||
|
|
||||||
|
The following patches have been verified to apply to the applicable
|
||||||
|
FreeBSD release branches.
|
||||||
|
|
||||||
|
a) Download the relevant patch from the location below, and verify the
|
||||||
|
detached PGP signature using your PGP utility.
|
||||||
|
|
||||||
|
[FreeBSD 11.2]
|
||||||
|
# fetch https://security.FreeBSD.org/patches/SA-XX:XX/XXXX.patch
|
||||||
|
# fetch https://security.FreeBSD.org/patches/SA-XX:XX/XXXX.patch.asc
|
||||||
|
# gpg --verify XXXX.patch.asc
|
||||||
|
|
||||||
|
b) Apply the patch. Execute the following commands as root:
|
||||||
|
|
||||||
|
# cd /usr/src
|
||||||
|
# patch < /path/to/patch
|
||||||
|
|
||||||
|
<for a userland utility:>
|
||||||
|
|
||||||
|
c) Recompile the operating system using buildworld and installworld as
|
||||||
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
||||||
|
|
||||||
|
<for a daemons>
|
||||||
|
|
||||||
|
c) Recompile the operating system using buildworld and installworld as
|
||||||
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
||||||
|
|
||||||
|
Restart the applicable daemons, or reboot the system.
|
||||||
|
|
||||||
|
<for a common library>
|
||||||
|
|
||||||
|
c) Recompile the operating system using buildworld and installworld as
|
||||||
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
||||||
|
|
||||||
|
Restart all daemons that use the library, or reboot the system.
|
||||||
|
|
||||||
|
<for a kernel vulnerability:>
|
||||||
|
|
||||||
|
c) Recompile your kernel as described in
|
||||||
|
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
|
||||||
|
system.
|
||||||
|
|
||||||
|
VI. Correction details
|
||||||
|
|
||||||
|
The following list contains the correction revision numbers for each
|
||||||
|
affected branch.
|
||||||
|
|
||||||
|
Branch/path Revision
|
||||||
|
-------------------------------------------------------------------------
|
||||||
|
stable/12/ rXXXXXX
|
||||||
|
releng/12.0/ rXXXXXX
|
||||||
|
stable/11/ rXXXXXX
|
||||||
|
releng/11.2/ rXXXXXX
|
||||||
|
-------------------------------------------------------------------------
|
||||||
|
|
||||||
|
To see which files were modified by a particular revision, run the
|
||||||
|
following command, replacing NNNNNN with the revision number, on a
|
||||||
|
machine with Subversion installed:
|
||||||
|
|
||||||
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
||||||
|
|
||||||
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
||||||
|
|
||||||
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
||||||
|
|
||||||
|
VII. References
|
||||||
|
|
||||||
|
<other info on vulnerability>
|
||||||
|
|
||||||
|
<URL:https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-XXXX-XXXX>
|
||||||
|
|
||||||
|
The latest revision of this advisory is available at
|
||||||
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-SA-XX:XX.XXXXX.asc>
|
||||||
140
en_US.ISO8859-1/htdocs/security/errata-template.txt
Normal file
140
en_US.ISO8859-1/htdocs/security/errata-template.txt
Normal file
|
|
@ -0,0 +1,140 @@
|
||||||
|
=============================================================================
|
||||||
|
FreeBSD-EN-ERRATA_TEMPLATE Errata Notice
|
||||||
|
The FreeBSD Project
|
||||||
|
|
||||||
|
Topic:
|
||||||
|
|
||||||
|
Category: < core | contrib >
|
||||||
|
Module: <module name>
|
||||||
|
Announced: 2019-XX-XX
|
||||||
|
Credits:
|
||||||
|
Affects: <affected versions>
|
||||||
|
<e.g., "All supported versions of FreeBSD.", "FreeBSD
|
||||||
|
12.0 and later.", "FreeBSD 12.x", or "FreeBSD 11.2">
|
||||||
|
Corrected: 2019-XX-XX XX:XX:XX UTC (stable/12, 12.0-STABLE)
|
||||||
|
2019-XX-XX XX:XX:XX UTC (releng/12.0, 12.0-RELEASE-pXX)
|
||||||
|
2019-XX-XX XX:XX:XX UTC (stable/11, 11.2-STABLE)
|
||||||
|
2019-XX-XX XX:XX:XX UTC (releng/11.2, 11.2-RELEASE-pXX)
|
||||||
|
|
||||||
|
For general information regarding FreeBSD Errata Notices and Security
|
||||||
|
Advisories, including descriptions of the fields above, security
|
||||||
|
branches, and the following sections, please visit
|
||||||
|
<URL:https://security.FreeBSD.org/>.
|
||||||
|
|
||||||
|
I. Background
|
||||||
|
|
||||||
|
<brief description of what the affected bits are supposed to do>
|
||||||
|
|
||||||
|
II. Problem Description
|
||||||
|
|
||||||
|
<detailed description of the problem>
|
||||||
|
|
||||||
|
III. Impact
|
||||||
|
|
||||||
|
<description as to why the above problem is bad>
|
||||||
|
|
||||||
|
IV. Workaround
|
||||||
|
|
||||||
|
<If no workaround exists:>
|
||||||
|
No workaround is available.
|
||||||
|
|
||||||
|
<... but some systems are unaffected:>
|
||||||
|
No workaround is available. <insert simple description of some
|
||||||
|
systems that are not vulnerable>
|
||||||
|
|
||||||
|
<If a workaround exists:>
|
||||||
|
<insert workaround here>
|
||||||
|
|
||||||
|
V. Solution
|
||||||
|
|
||||||
|
<insert solution here>
|
||||||
|
|
||||||
|
Perform one of the following:
|
||||||
|
|
||||||
|
1) Upgrade your system to a supported FreeBSD stable or release / security
|
||||||
|
branch (releng) dated after the correction date.
|
||||||
|
[XX Needs reboot? Mention please]
|
||||||
|
|
||||||
|
2) To update your system via a binary patch:
|
||||||
|
|
||||||
|
Systems running a RELEASE version of FreeBSD on the i386 or amd64
|
||||||
|
platforms can be updated via the freebsd-update(8) utility:
|
||||||
|
|
||||||
|
# freebsd-update fetch
|
||||||
|
# freebsd-update install
|
||||||
|
[XX Needs reboot? Mention please]
|
||||||
|
|
||||||
|
3) To update your system via a source code patch:
|
||||||
|
|
||||||
|
The following patches have been verified to apply to the applicable
|
||||||
|
FreeBSD release branches.
|
||||||
|
|
||||||
|
a) Download the relevant patch from the location below, and verify the
|
||||||
|
detached PGP signature using your PGP utility.
|
||||||
|
|
||||||
|
[FreeBSD 11.2]
|
||||||
|
# fetch https://security.FreeBSD.org/patches/EN-XX:XX/XXXX.patch
|
||||||
|
# fetch https://security.FreeBSD.org/patches/EN-XX:XX/XXXX.patch.asc
|
||||||
|
# gpg --verify XXXX.patch.asc
|
||||||
|
|
||||||
|
b) Apply the patch. Execute the following commands as root:
|
||||||
|
|
||||||
|
# cd /usr/src
|
||||||
|
# patch < /path/to/patch
|
||||||
|
|
||||||
|
<for a userland utility:>
|
||||||
|
|
||||||
|
c) Recompile the operating system using buildworld and installworld as
|
||||||
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
||||||
|
|
||||||
|
<for a daemons>
|
||||||
|
|
||||||
|
c) Recompile the operating system using buildworld and installworld as
|
||||||
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
||||||
|
|
||||||
|
Restart the applicable daemons, or reboot the system.
|
||||||
|
|
||||||
|
<for a common library>
|
||||||
|
|
||||||
|
c) Recompile the operating system using buildworld and installworld as
|
||||||
|
described in <URL:https://www.FreeBSD.org/handbook/makeworld.html>.
|
||||||
|
|
||||||
|
Restart all daemons that use the library, or reboot the system.
|
||||||
|
|
||||||
|
<for a kernel bug:>
|
||||||
|
|
||||||
|
c) Recompile your kernel as described in
|
||||||
|
<URL:https://www.FreeBSD.org/handbook/kernelconfig.html> and reboot the
|
||||||
|
system.
|
||||||
|
|
||||||
|
VI. Correction details
|
||||||
|
|
||||||
|
The following list contains the correction revision numbers for each
|
||||||
|
affected branch.
|
||||||
|
|
||||||
|
Branch/path Revision
|
||||||
|
-------------------------------------------------------------------------
|
||||||
|
stable/12/ rXXXXXX
|
||||||
|
releng/12.0/ rXXXXXX
|
||||||
|
stable/11/ rXXXXXX
|
||||||
|
releng/11.2/ rXXXXXX
|
||||||
|
-------------------------------------------------------------------------
|
||||||
|
|
||||||
|
To see which files were modified by a particular revision, run the
|
||||||
|
following command, replacing NNNNNN with the revision number, on a
|
||||||
|
machine with Subversion installed:
|
||||||
|
|
||||||
|
# svn diff -cNNNNNN --summarize svn://svn.freebsd.org/base
|
||||||
|
|
||||||
|
Or visit the following URL, replacing NNNNNN with the revision number:
|
||||||
|
|
||||||
|
<URL:https://svnweb.freebsd.org/base?view=revision&revision=NNNNNN>
|
||||||
|
|
||||||
|
VII. References
|
||||||
|
|
||||||
|
<other info on the problem>
|
||||||
|
|
||||||
|
<URL:https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=XXXXXX>
|
||||||
|
|
||||||
|
The latest revision of this advisory is available at
|
||||||
|
<URL:https://security.FreeBSD.org/advisories/FreeBSD-EN-XX:XX.XXXXX.asc>
|
||||||
|
|
@ -49,6 +49,13 @@
|
||||||
<li>Example code if possible.</li>
|
<li>Example code if possible.</li>
|
||||||
</ul>
|
</ul>
|
||||||
|
|
||||||
|
<p>Whenever possible, including the background, problem
|
||||||
|
description, impact, and workaround (if applicable) using the
|
||||||
|
templates for <a
|
||||||
|
href="advisory-template.txt">security advisories</a> and <a
|
||||||
|
href="errata-template.txt">errata notices</a> as appropriate
|
||||||
|
would also be helpful.</p>
|
||||||
|
|
||||||
<p>After this information has been reported the Security Officer
|
<p>After this information has been reported the Security Officer
|
||||||
or a Security Team delegate will get back to you.</p>
|
or a Security Team delegate will get back to you.</p>
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue