mirror of
https://github.com/ansible/awx.git
synced 2026-10-29 22:03:20 -02:30
43 lines
2.2 KiB
Markdown
43 lines
2.2 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a security vulnerability
|
|
|
|
All security vulnerability reports MUST be submitted by email to: [security@ansible.com](mailto:security@ansible.com)
|
|
|
|
Security vulnerabilities MUST NOT be reported through public channels such as GitHub issues, pull requests, the Ansible Forum, or social media.
|
|
|
|
## What to include
|
|
|
|
When submitting a vulnerability report, include the following:
|
|
|
|
* **Title** (required): Clear, concise, descriptive summary.
|
|
* **Impacted project** (required): Ideally a link to the GitHub project.
|
|
* **Reporter details** (optional): Your name or handle and affiliation.
|
|
* **Vulnerability description** (required): Technical details of the issue.
|
|
* **Affected versions** (required): Known affected version(s), and ideally all affected versions.
|
|
* **Reproduction steps** (required): Minimal example to reproduce the issue.
|
|
* **Impact assessment** (required): Potential exploit scenarios and severity.
|
|
* **Suggested fix** (optional): Proposed remediation, if any.
|
|
* **Disclosure status** (required): Whether this has been shared with other parties or published and your plan for future sharing (e.g., at a conference).
|
|
|
|
## Timeline
|
|
|
|
* The Ansible Security Team aims to confirm receipt of vulnerability reports within one (1) business day.
|
|
* Our goal is to assess the report, coordinate fix and disclosure as quickly as possible.
|
|
* All confirmed vulnerabilities are addressed according to severity and impact.
|
|
|
|
## Backports
|
|
|
|
Generally, only the latest release of this project receives security updates.
|
|
Earlier versions may receive critical fixes on a best-effort basis.
|
|
|
|
## Ansible Security Policy
|
|
|
|
For the complete Ansible Security Policy, including what qualifies as a reportable vulnerability, severity classification, the response process, coordinated disclosure, and the vulnerability management process, see [ansible.com/security](https://ansible.com/security).
|
|
|
|
## EU Cyber Resilience Act: Open-Source Steward Statement
|
|
|
|
This project is stewarded by **Red Hat, Inc.**, an open-source software steward as defined in Article 3(14) of the [EU Cyber Resilience Act (Regulation 2024/2847)](https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng).
|
|
|
|
Contact: [cra-steward@redhat.com](mailto:cra-steward@redhat.com)
|