RFC: Vulnerability response runbook by pchickey · Pull Request #20 · bytecodealliance/rfcs

pchickey · 2022-02-17T23:27:46Z

This RFC proposes the vulnerability response process used by the Bytecode Alliance. It is structured as a runbook: a set of steps to be followed by the team responding to a discovered vulnerability.

It documents the process we followed for several different security advisories in Wasmtime and Lucet, for example:
GHSA-88xq-w8cq-xfg7
GHSA-hf79-8hjp-rrvq

cfallin · 2022-02-17T23:42:48Z

On initial read, this looks really good and is quite complete!

Only thing I would add is that, if the vulnerability is in a Rust crate used by others, adding an entry to the rustsec database is a good last step, after the CVE exists and is public. An example PR is here for last year's Cranelift CVE.

Co-authored-by: bjorn3 <bjorn3@users.noreply.github.com>

jfoote

Great baseline, well done @pchickey. I provided some spellcheck and also left one more substantive comment for your consideration.

bnjbvr · 2022-02-23T09:28:56Z

(Forgot to say, sorry!) Great write-up, this definitely will streamline and structure the incident handling process!

@jfoote

Thank you @jfoote and @bjorn3 Co-authored-by: Jonathan Foote <jonathan@foote.pub>

pchickey · 2022-02-28T17:21:12Z

@cfallin Thanks, added a RustSec database step to the final section. We haven't been consistent in publishing to that database, but there is no reason not to be.

per discussion https://github.com/bytecodealliance/rfcs/pull/20/files#r948923134

bnjbvr

Thanks a lot!

pchickey · 2022-08-18T18:53:33Z

fitzgen · 2022-08-18T23:42:38Z

As per the RFC process this RFC is entering its 10 day final comment period.

If no objections have been raised by 2022-08-28, we will merge this RFC.

fitzgen · 2022-08-29T20:25:20Z

The final comment period has elapsed without any objections, so I'm going to merge this!

initial document: vulnerability response runbook
2136bd5

bjorn3 reviewed Feb 18, 2022
View reviewed changes