diff options
Diffstat (limited to 'docs/en')
| -rwxr-xr-x | docs/en/index.rst | 6 | ||||
| -rw-r--r-- | docs/en/security.rst | 76 |
2 files changed, 82 insertions, 0 deletions
diff --git a/docs/en/index.rst b/docs/en/index.rst index 98a74c61..f33ca558 100755 --- a/docs/en/index.rst +++ b/docs/en/index.rst @@ -157,3 +157,9 @@ Considering USB performance requirements to reach theoretical USB hardware bandw :caption: Commercial Support support/index + +.. toctree:: + :maxdepth: 1 + :caption: Security + + security diff --git a/docs/en/security.rst b/docs/en/security.rst new file mode 100644 index 00000000..7643d0ca --- /dev/null +++ b/docs/en/security.rst @@ -0,0 +1,76 @@ +Security Advisories and CVE Catalog +=================================== + +Report a vulnerability +---------------------- + +Please follow the repository's +`security policy <https://github.com/cherry-embedded/CherryUSB/security/policy>`_ +or email ``[email protected]``. + +Published advisories +-------------------- + +The authoritative GitHub advisory list is available at +`CherryUSB Security Advisories <https://github.com/cherry-embedded/CherryUSB/security/advisories>`_. + +No entries have been added to this catalog yet. This does not imply that no +vulnerabilities or external advisories exist. Add entries only after the +maintainers have confirmed the issue and approved public disclosure. + +Information required for each entry +----------------------------------- + +* Advisory title and publication date. +* GHSA identifier and public advisory URL, if assigned. +* CVE identifier, if assigned; an advisory may be published without a CVE. +* Affected releases or commits and any required build configuration. +* Fixed releases and full fix commit identifiers. +* Affected host/device classes and controller drivers, where applicable. +* Impact, trigger conditions, and available workarounds. +* CWE and CVSS version/vector/score, if assessed. +* Reporter attribution, with the reporter's consent. + +Do not infer an affected version range from the fix commit alone, invent CVE +identifiers, or treat an internal code review finding as a published advisory. + +CVE advisory template +--------------------- + +This is a template, not a published advisory. Replace ``xxxx`` with confirmed information. + +CVE-xxxx-xxxx: xxxx +~~~~~~~~~~~~~~~~~~~ + +:Publication date: xxxx +:CVE ID: CVE-xxxx-xxxx +:GHSA ID: GHSA-xxxx-xxxx-xxxx +:Severity: xxxx +:CWE: CWE-xxxx +:CVSS version, vector, and score: xxxx +:Affected versions: xxxx +:Fixed versions: xxxx +:Fix commit: xxxx +:Affected components: xxxx +:Advisory URL: xxxx +:Reporter: xxxx + +**Description** + +xxxx + +**Impact and trigger conditions** + +xxxx + +**Fix** + +xxxx + +**Workarounds** + +xxxx + +**References** + +* xxxx |