Open rcthomas opened 2 years ago
a suggestion suggestion would be to also have a list of CVE on a given page on Jupyter.org (and rss feeds?).
Im wondering if there is a way to get notified for changes to the github advisory database. Like set a query: https://github.com/advisories?query=jupyter and recieve email when a new entry matches.
@Carreau I'd like to document the current processes for vulnerability handling. Do you think this is something we could capture during one of the security calls? From there maybe we take it to the Steering Council as a JEP and later refinement.
I'd like to document the current processes for vulnerability handling. Do you think this is something we could capture during one of the security calls? From there maybe we take it to the Steering Council as a JEP and later refinement.
Yes we can try to capture that, one of the problem is that there is no real process. It's anyone that has access to security@ipython.org does their best.
Here's a sketch of what we've been doing in practice:
What we haven't yet established is where else to announce these vulnerabilities.
@jweill-aws I've updated the comment above as per our discussion today in the server meeting.
At today's Jupyter community call @sgibson91 mentioned the recent Travis CI issue and whether we had a process for alerting Jupyter developers about those kinds of vulnerabilities. What are the best processes/procedures for getting the word out? We've got, or could use:
Other ideas?