@@ -19,10 +19,10 @@ Resolving Process
1919For each report, we first try to confirm the vulnerability. When it is
2020confirmed, the core-team works on a solution following these steps:
2121
22- 1 . Send an acknowledgement to the reporter;
23- 2 . Work on a patch;
24- 3 . Get a CVE identifier from mitre.org;
25- 4 . Write a security announcement for the official Symfony `blog `_ about the
22+ # . Send an acknowledgement to the reporter;
23+ # . Work on a patch;
24+ # . Get a CVE identifier from mitre.org;
25+ # . Write a security announcement for the official Symfony `blog `_ about the
2626 vulnerability. This post should contain the following information:
2727
2828 * a title that always include the "Security release" string;
@@ -32,12 +32,12 @@ confirmed, the core-team works on a solution following these steps:
3232 * how to patch/upgrade/workaround affected applications;
3333 * the CVE identifier;
3434 * credits.
35- 5 . Send the patch and the announcement to the reporter for review;
36- 6 . Apply the patch to all maintained versions of Symfony;
37- 7 . Package new versions for all affected versions;
38- 8 . Publish the post on the official Symfony `blog `_ (it must also be added to
35+ # . Send the patch and the announcement to the reporter for review;
36+ # . Apply the patch to all maintained versions of Symfony;
37+ # . Package new versions for all affected versions;
38+ # . Publish the post on the official Symfony `blog `_ (it must also be added to
3939 the "`Security Advisories `_" category);
40- 9 . Update the security advisory list (see below).
40+ # . Update the security advisory list (see below).
4141
4242.. note ::
4343
@@ -61,23 +61,23 @@ As Symfony is used by many large Open-Source projects, we standardized the way
6161the Symfony security team collaborates on security issues with downstream
6262projects. The process works as follows:
6363
64- 1 . After the Symfony security team has acknowledged a security issue, it
65- immediately sends an email to the downstream project security teams to inform
66- them of the issue;
64+ # . After the Symfony security team has acknowledged a security issue, it
65+ immediately sends an email to the downstream project security teams to
66+ inform them of the issue;
6767
68- 2 . The Symfony security team creates a private Git repository to ease the
69- collaboration on the issue and access to this repository is given to the
70- Symfony security team, to the Symfony contributors that are impacted by the
71- issue, and to one representative of each downstream projects;
68+ # . The Symfony security team creates a private Git repository to ease the
69+ collaboration on the issue and access to this repository is given to the
70+ Symfony security team, to the Symfony contributors that are impacted by
71+ the issue, and to one representative of each downstream projects;
7272
73- 3 . All people with access to the private repository work on a solution to
74- solve the issue via pull requests, code reviews, and comments;
73+ # . All people with access to the private repository work on a solution to
74+ solve the issue via pull requests, code reviews, and comments;
7575
76- 4 . Once the fix is found, all involved projects collaborate to find the best
77- date for a joint release (there is no guarantee that all releases will be at
78- the same time but we will try hard to make them at about the same time). When
79- the issue is not known to be exploited in the wild, a period of two weeks
80- seems like a reasonable amount of time.
76+ # . Once the fix is found, all involved projects collaborate to find the best
77+ date for a joint release (there is no guarantee that all releases will
78+ be at the same time but we will try hard to make them at about the same
79+ time). When the issue is not known to be exploited in the wild, a period
80+ of two weeks seems like a reasonable amount of time.
8181
8282The list of downstream projects participating in this process is kept as small
8383as possible in order to better manage the flow of confidential information
0 commit comments