Vulnerability Disclosures
The OpenSSF Vulnerability Disclosures Working Group seeks to help improve the overall security of the open source software ecosystem by helping mature and advocate well-managed vulnerability reporting and communication.
Objective
The OpenSSF Vulnerability Disclosures Working Group seeks to help improve the overall security of the open source software ecosystem by helping develop and advocate well-managed vulnerability reporting and communication. We plan on addressing this challenge through the following actions:
-
Documenting and promoting reasonable vulnerability disclosure and coordination practices within the OSS ecosystem for component maintainers and community members by providing documented standards and educational materials.
-
Identifying vulnerability disclosure pain points for OSS maintainer, consumers, and security researchers and take steps to address them.
-
Facilitate the development and adoption of a standards-based OSS Vulnerability Exchange that uses existing industry formats and allows OSS projects of all sizes to be able to report, share, and learn about vulnerabilities within OSS components.
Current work
- Guides to coordinated vulnerability disclosure for open source software projects to assist projects in handling vulnerabilities.
- Open Source Vulnerability Schema - see also osv.dev.
- OSS-SIRT SIG (incubating) - SIG dedicated to update of OpenSSF Mobilization Plan Stream 5 working to create upstream open source incident response team.
- Vulnerability AutoFix SIG (incubating) - Group dedicated to finding best practices in disclosing open source vulnerabilities and fixes to projects at scale
- OpenVEX SIG (sandbox)- Group dedicated to OpenVEX and VEX industry work. OpenVEX is an implementation of the Vulnerability Exploitability Exchange (VEX for short) that is designed to be minimal, compliant, interoperable, and embeddable.
Past Work
- Unified list of metadata for vulnerability reports and disclosures
- OpenSSF Recommendations for Open Source Software Vulnerability Disclosure Whitepaper (incubating) - a draft longer paper on various related topics
Get Involved
We communicate on the Vulnerability Disclosure mailing list. Manage your subscriptions to Open SSF mailing lists.
Join us on Slack at https://openssf.slack.com/messages/wg_vulnerability_disclosures
- Recent Update to OSSF TAC on WG activities
Meeting Times
The working group meets every two weeks, on Wednesdays at 11:00 AM ET / 8:00 AM PT. Currently we are using Zoom for working group meetings. The invite is available on the OpenSSF Community Calendar.
The Working Group will hold a monthly APAC-friendly call at 6:00pm ET / 3:00pm PT the last Thursday of each month. The invite is available on the OpenSSF Community Calendar.
| Effort | Meeting Times | Meeting Notes/Agenda | Git Repo | Slack Channel | Mailing List |
|---|---|---|---|---|---|
| Full WG | Every 2nd Wednesday 8:00a PT/11:00a ET/1500 UTC | Meeting Notes | Git Repo | Slack | Mailing List |
| WG - APAC TZ | Occurs Last Thursday monthly 3:00p PT/6:00p ET/2200 UTC | Meeting Notes | Git Repo | Slack | Mailing List |
| OSS-SIRT | Every 2nd Tuesday 6:00a PT/9:00a ET/1300 UTC | Meeting Notes | Git Repo | Slack | Mailing List |
| OSV schema | TBD | Meeting Notes | Git Repo | Slack | Mailing List |
| OpenVEX | Every 2nd Monday 12:00p PT/3:00p ET/1900 UTC | Meeting Notes | Git Repo | Slack | Mailing List |
| Vuln Autofix SIG | Occurs every 2nd Wednesday 1:00p PT/4:00p ET/2000 UTC | Meeting Notes | Git Repo | Slack | Mailing List |
Meeting Notes
Governance
We use the vulnerability-disclosures-wg GitHub team.
The CHARTER.md outlines the scope and governance of our group activities.
- Lead - Christopher "CRob" Robinson
- Co-Lead -
- Backlog Warden -
Project Maintainers
Project Collaborators
- Crystal Hazen, HackerOne
- Jonathan Leitschuh, Dan Kaminsky Fellowship - HUMAN
- Madison Oliver, GitHub Security Lab
- VM Brasseur, WiPro
- Jennifer Mitchell, Tidelift
- David A Wheeler, LF/OSSF
- Randall T. Vasquez (SKF/Gentoo/Homebrew)
Project Contributors
- Avishay Balter, Microsoft
- Jeffrey Borek, IBM
- Jennifer Fernick, NCC Group
- Eric Hatleback, CERT/CC
- Jason Keirstead, IBM
- Arnaud Le Hors, IBM
- Art Manion, ANALYGENCE
- MegaZone, F5
- Nathan Menhorn, AMD
- Yogesh Mittal, Red Hat
- Yotam Perkal, Rezilion
- Francis Perron, Google
- Sandipan Roy, RedHat
- Paulo Flabiano Smorigo (Ubuntu/Canonical)
- Eric Tice, Wipro
- Kayla Underkoffler, HackerOne
- Jay White, Microsoft
A listing of our current and past group members.
Antitrust Policy Notice
Linux Foundation meetings involve participation by industry competitors, and it is the intention of the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws.
Examples of types of actions that are prohibited at Linux Foundation meetings and in connection with Linux Foundation activities are described in the Linux Foundation Antitrust Policy available at http://www.linuxfoundation.org/antitrust-policy. If you have questions about these matters, please contact your company counsel, or if you are a member of the Linux Foundation, feel free to contact Andrew Updegrove of the firm of Gesmer Updegrove LLP, which provides legal counsel to the Linux Foundation.