diff --git a/SECURITY.md b/SECURITY.md index a9094fb0bb9624122795f236632f41c5a35d2475..94606b41d7f1a0809fa4a6cb80a65ee6da5d0d24 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,9 +2,10 @@ ## Supported Versions -The following matrix shows the versions currently maintained by the -TYPO3 Community. Sprint releases (versions before 12.4.0 and 11.5.0, -in their corresponding branches) are neither maintained nor supported. +The following matrix shows the TYPO3 versions currently maintained by the TYPO3 +community. Sprint releases (versions before 12.4.0 and 11.5.0, in their +corresponding branches) have reached their end of support and don't receive any +further bug fixes or security patches. | Version | Supported | |----------|--------------------| @@ -18,40 +19,52 @@ in their corresponding branches) are neither maintained nor supported. ## Reporting a Vulnerability -Please report possible vulnerabilities to [security@typo3.org](mailto:security@typo3.org) +Please report vulnerabilities to [security@typo3.org](mailto:security@typo3.org). +Your report should include the following details: -* Name the affected project (either TYPO3 Core or a TYPO3 extension/plugin) -* Name the exact version or version range that has been analysed -* Provide a step-by-step description of how to exploit the potential vulnerability +* The affected project (either the TYPO3 Core or a TYPO3 extension). +* The exact version or version range that you analysed. +* A step-by-step explanation of how to exploit the potential vulnerability. -### Coordinated Disclosure +You can use the following GPG/PGP key ID to optionally encrypt your messages to +[security@typo3.org](mailto:security@typo3.org): -The [TYPO3 Security Team](https://typo3.org/community/teams/security) will -coordinate with core mergers or corresponding extension/plugin maintainers and -other affected parties. When a security fix is ready, we will package new -releases and announce the fix to the public using various communication channels like: +* Key ID: `C05FBE60` +* Fingerprint: `B41CÂ C3EFÂ 373EÂ 0F5CÂ 7018Â Â 7FE9Â 3BEFÂ BD27Â C05FÂ BE60` + +You can download the public key from the following sources: + +* [typo3.org](https://typo3.org/fileadmin/t3o_common_storage/keys/B41CC3EF373E0F5C70187FE93BEFBD27C05FBE60.asc) +* [keys.openpgp.org](https://keys.openpgp.org/vks/v1/by-fingerprint/B41CC3EF373E0F5C70187FE93BEFBD27C05FBE60) + +## Coordinated Disclosure + +> :warning: We urge security researchers not to publish vulnerabilities in issue trackers or +discuss them publicly (e.g. on Slack or Twitter). + +The [TYPO3 Security Team](https://typo3.org/community/teams/security) coordinates +the process with the TYPO3 core developers, extension maintainers and other +affected parties. Once a security fix is available, we prepare a new release and +publish the fixed version. At the same time, we communicate the vulnerability and +the fix to the public by using various communication channels such as: * [TYPO3 Security Advisories](https://typo3.org/help/security-advisories) * [TYPO3 Security Team on Twitter](https://twitter.com/typo3_security) * [#announce channel on Slack](https://typo3.org/community/meet/how-to-use-slack-in-the-typo3-community) -* [TYPO3 Announce Mailing List](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) - -The TYPO3 Security Team is taking care of requesting CVE IDs (common vulnerability and exposer identifiers). -Please do not post or publish vulnerabilities to public issue trackers or discuss them on Slack or Twitter. +* [TYPO3 Announce Mailing List](https://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) -### Message Encryption +The TYPO3 Security Team takes care of requesting [CVE IDs](https://www.cve.org/About/Process#CVERecordLifecycle) +(Common Vulnerabilities and Exposures identifiers). -It is possible to send GPG/PGP encrypted emails to [security@typo3.org](mailto:security@typo3.org) using key id -`C05FBE60` (complete fingerprint `B41CÂ C3EFÂ 373EÂ 0F5CÂ 7018Â Â 7FE9Â 3BEFÂ BD27Â C05FÂ BE60`): +## TYPO3 Release Dates ("Patchday") -* download [public key file from typo3.org](https://typo3.org/fileadmin/t3o_common_storage/keys/B41CC3EF373E0F5C70187FE93BEFBD27C05FBE60.asc) -* download [public key file from keys.openpgp.org](https://keys.openpgp.org/vks/v1/by-fingerprint/B41CC3EF373E0F5C70187FE93BEFBD27C05FBE60) +We aim to publish TYPO3 maintenance releases on Tuesdays as a general rule. +However, exceptions apply (e.g. public holidays). Release dates of +[maintenance releases](https://typo3.org/cms/roadmap/maintenance-releases) +are scheduled in advance. These releases can contain security fixes. -## TYPO3 Release Dates / "Patchday" +## Further Information -TYPO3 releases (including possible security fixes) are usually published -on Tuesdays (except on holidays like Christmas or New Year). - -The [Maintenance Releases](https://typo3.org/cms/roadmap/maintenance-releases) -for stable versions have been scheduled in advance - it is very likely that -security fixes will also be released on these dates. +* [TYPO3 Security Team](https://typo3.org/community/teams/security) +* [TYPO3 Security Advisories](https://typo3.org/help/security-advisories) +* [TYPO3 Security Guidelines](https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/Security/Index.html)