Security: Difference between revisions
Jump to navigation
Jump to search
No edit summary |
No edit summary |
||
| (2 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
If you have details of a suspected security vulnerability in Lustre code that you wish to report then please [mailto:security@ | If you have details of a suspected security vulnerability in Lustre code that you wish to report then please [mailto:security@thelustrecollective.com email us at [email protected]] with the details. | ||
Please do not file a public JIRA issue for a vulnerability - we do not want to draw attention to the vulnerability until | Please do not file a public JIRA issue for a security vulnerability - we do not want to draw attention to the vulnerability until a fix has been developed and administrators have been alerted and have had some time to put a mitigation in place. | ||
Ideally the reporting email should have as much detail as possible: | Ideally the reporting email should have as much detail as possible: | ||
| Line 10: | Line 10: | ||
* your intentions around disclosing the details of the vulnerability | * your intentions around disclosing the details of the vulnerability | ||
We aim to respond to any such reports within three days of receipt. | We aim to respond to any such reports within three business days of receipt. | ||
Latest revision as of 06:43, 3 May 2026
If you have details of a suspected security vulnerability in Lustre code that you wish to report then please email us at [email protected] with the details.
Please do not file a public JIRA issue for a security vulnerability - we do not want to draw attention to the vulnerability until a fix has been developed and administrators have been alerted and have had some time to put a mitigation in place.
Ideally the reporting email should have as much detail as possible:
- reproducer, versions affected, fix if available, etc.
- indicate to whom (individual and/or affiliation) that credit for finding the issue should be reported
- details of any CVE already reserved
- your intentions around disclosing the details of the vulnerability
We aim to respond to any such reports within three business days of receipt.