Updaded SECURITY*.md
This commit is contained in:
mdecimus
158
SECURITY.md
158
SECURITY.md
@@ -4,41 +4,151 @@
|
||||
|
||||
We provide security updates for the following versions of Stalwart:
|
||||
|
||||
| Version | Supported |
|
||||
| ------- | ------------------ |
|
||||
| 0.12.x | :white_check_mark: |
|
||||
| 0.11.x | :white_check_mark: |
|
||||
| < 0.10 | :x: |
|
||||
| Version | Supported | End of Support |
|
||||
| ------- | ------------------ | -------------- |
|
||||
| 0.12.x | :white_check_mark: | TBD |
|
||||
| 0.11.x | :white_check_mark: | 2025-12-31 |
|
||||
| < 0.11 | :x: | Ended |
|
||||
|
||||
**Note**: We typically support the current major version and one previous major version. Users are strongly encouraged to upgrade to the latest version for the best security posture.
|
||||
|
||||
## Reporting a Vulnerability
|
||||
|
||||
We take the security of Stalwart very seriously. If you believe you've found a security vulnerability, we encourage you to inform us responsibly.
|
||||
We take the security of Stalwart very seriously. If you believe you've found a security vulnerability, we encourage you to inform us responsibly through coordinated disclosure.
|
||||
|
||||
**Do not report security vulnerabilities through public GitHub issues.**
|
||||
### How to Report
|
||||
|
||||
Instead, please send an email to us at hello@stalw.art (do not use this email for support questions). You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message.
|
||||
**Do not report security vulnerabilities through public GitHub issues, discussions, or social media.**
|
||||
|
||||
To help us better understand the nature and scope of the potential issue, please describe as much as you can about the vulnerability:
|
||||
Instead, please use one of these secure channels:
|
||||
|
||||
- Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
|
||||
- Full paths of source file(s) related to the manifestation of the issue
|
||||
- The location of the affected source code (tag/branch/commit or direct URL)
|
||||
- Any special configuration required to reproduce the issue
|
||||
- Step-by-step instructions to reproduce the issue
|
||||
- Proof-of-concept or exploit code
|
||||
- Impact of the issue, including how an attacker might exploit the issue
|
||||
1. **Email** (preferred): Send details to `security@stalw.art`
|
||||
2. **GitHub Security Advisories**: Use the "Report a vulnerability" button in the Security tab
|
||||
3. **Backup contact**: If no response within 48 hours, email `hello@stalw.art`
|
||||
|
||||
This information will help us triage your report more quickly.
|
||||
### What to Include
|
||||
|
||||
Our security team will acknowledge your email within 24 hours, and you'll receive a more detailed response to your email within 48 hours indicating the next steps in handling your report.
|
||||
To help us understand and address the issue quickly, please include:
|
||||
|
||||
## Policy
|
||||
**Required Information:**
|
||||
- Brief description of the vulnerability type
|
||||
- Affected version(s) and components
|
||||
- Steps to reproduce the issue
|
||||
- Impact assessment (what could an attacker achieve?)
|
||||
|
||||
If you follow these guidelines when reporting an issue to us:
|
||||
**Helpful Additional Details:**
|
||||
- Full paths of affected source files
|
||||
- Specific commit/branch where the issue exists
|
||||
- Required configuration to reproduce
|
||||
- Proof-of-concept code (if available)
|
||||
- Suggested mitigation or fix (if you have ideas)
|
||||
|
||||
- We will acknowledge your report & provide an estimated timeframe for a fix.
|
||||
- We will notify you when the issue is resolved.
|
||||
- We will not take legal action against or suspend or terminate your access to the project.
|
||||
### Our Response Process
|
||||
|
||||
We strive to keep all our users safe and will make our best effort to promptly fix any security issue.
|
||||
**Timeline Commitments:**
|
||||
- **Initial acknowledgment**: Within 24 hours
|
||||
- **Detailed response**: Within 72 hours
|
||||
- **Status updates**: Every 7 days until resolved
|
||||
- **Resolution target**: 90 days for most issues
|
||||
|
||||
**What We'll Do:**
|
||||
1. Acknowledge your report and assign a tracking ID
|
||||
2. Assess the vulnerability and determine severity
|
||||
3. Develop and test a fix
|
||||
4. Coordinate disclosure timeline with you
|
||||
5. Release security update and publish advisory
|
||||
6. Credit you in our security advisory (if desired)
|
||||
|
||||
## Disclosure Policy
|
||||
|
||||
We follow responsible disclosure principles:
|
||||
|
||||
- **Coordinated disclosure**: We'll work with you to determine appropriate disclosure timing
|
||||
- **Typical timeline**: 90 days from report to public disclosure
|
||||
- **Early disclosure**: May occur if issue is being actively exploited
|
||||
- **Delayed disclosure**: May be necessary for complex issues requiring significant changes
|
||||
|
||||
## Scope
|
||||
|
||||
This security policy applies to:
|
||||
|
||||
**In Scope:**
|
||||
- Stalwart (all supported versions)
|
||||
- Official Docker images
|
||||
- Documentation that could lead to insecure configurations
|
||||
- Dependencies with security implications
|
||||
|
||||
**Out of Scope:**
|
||||
- Third-party integrations or plugins
|
||||
- Issues requiring physical access to the server
|
||||
- Social engineering attacks
|
||||
- Attacks requiring compromised credentials (unless the vulnerability enables credential compromise)
|
||||
- Theoretical vulnerabilities without practical exploitation
|
||||
|
||||
## Security Measures
|
||||
|
||||
**Our Commitments:**
|
||||
- Regular security audits of dependencies using `cargo audit`
|
||||
- Automated security scanning in CI/CD pipeline
|
||||
- Following Rust security best practices
|
||||
- Prompt security updates for critical dependencies
|
||||
- Security-focused code review process
|
||||
|
||||
**User Responsibilities:**
|
||||
- Keep Stalwart updated to supported versions
|
||||
- Follow security configuration guidelines
|
||||
- Implement proper network security (firewalls, TLS, etc.)
|
||||
- Regular security monitoring and logging
|
||||
- Secure credential management
|
||||
|
||||
## Legal Safe Harbor
|
||||
|
||||
We support security research conducted in good faith. If you follow these guidelines:
|
||||
|
||||
**We will NOT:**
|
||||
- Initiate legal action against you
|
||||
- Contact law enforcement about your research
|
||||
- Suspend or terminate your access to Stalwart services
|
||||
|
||||
**You must:**
|
||||
- Only test against your own Stalwart installations
|
||||
- Not access, modify, or delete user data
|
||||
- Not perform testing that could degrade service availability
|
||||
- Not publicly disclose the issue before coordinated disclosure
|
||||
- Act in good faith and not for malicious purposes
|
||||
|
||||
## Recognition
|
||||
|
||||
We believe in recognizing security researchers who help keep Stalwart secure:
|
||||
|
||||
- **Security Advisory Credits**: We'll credit you in our GitHub Security Advisories (unless you prefer to remain anonymous)
|
||||
- **Hall of Fame**: Significant contributors may be listed in our security acknowledgments
|
||||
- **Swag**: We may send Stalwart merchandise for notable contributions
|
||||
|
||||
## Security Updates
|
||||
|
||||
**Stay Informed:**
|
||||
- Subscribe to our [GitHub releases](https://github.com/stalwartlabs/stalwart/releases) for security updates
|
||||
- Join our community channels for security announcements
|
||||
- Enable GitHub notifications for security advisories
|
||||
|
||||
**Update Process:**
|
||||
- Security updates are published as patch releases (e.g., 0.12.1 → 0.12.2)
|
||||
- Critical vulnerabilities may receive out-of-band releases
|
||||
- Docker images are updated simultaneously with releases
|
||||
- Security advisories are published through GitHub Security Advisories
|
||||
|
||||
## Contact Information
|
||||
|
||||
- **Security reports**: security@stalw.art
|
||||
- **General inquiries**: hello@stalw.art
|
||||
- **PGP Key**: Available upon request for sensitive communications
|
||||
|
||||
## Additional Resources
|
||||
|
||||
- [Stalwart Security Incident Response Process](SECURITY_PROCESS.md)
|
||||
- [Security Configuration Guide](https://stalw.art/docs/install/security)
|
||||
- [Rust Security Advisory Database](https://rustsec.org/)
|
||||
|
||||
*This security policy is effective as of June 20, 2025 and may be updated periodically. Check back regularly for updates.*
|
||||
|
||||
|
||||
173
SECURITY_PROCESS.md
Normal file
173
SECURITY_PROCESS.md
Normal file
@@ -0,0 +1,173 @@
|
||||
# Stalwart Security Incident Response Checklist
|
||||
|
||||
## Phase 1 : Initial Assessment & Validation
|
||||
|
||||
### Updates
|
||||
|
||||
<< Use this section to detail the report received, initial assessment, and validation results >>
|
||||
|
||||
Example:
|
||||
|
||||
I've reviewed the security report and confirmed this vulnerability exists in Stalwart version X.Y.Z.
|
||||
|
||||
Assessment of exploitability:
|
||||
|
||||
- Attack complexity: [High/Medium/Low]
|
||||
- Prerequisites: [Authentication required/Network access/Specific configuration/etc.]
|
||||
- User interaction required: [Yes/No]
|
||||
|
||||
Potential impact:
|
||||
- Email data confidentiality: [At risk/Not affected]
|
||||
- Server integrity: [At risk/Not affected]
|
||||
- Service availability: [At risk/Not affected]
|
||||
- Estimated affected installations: [Number/Percentage]
|
||||
|
||||
### Resources
|
||||
|
||||
- [Stalwart Security Policy](https://github.com/stalwartlabs/stalwart/blob/main/SECURITY.mdy)
|
||||
- [CVE Scoring Calculator](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator)
|
||||
- [Rust Security Advisory Database](https://rustsec.org/)
|
||||
|
||||
### Tasks
|
||||
|
||||
- [ ] Reproduce the vulnerability in test environment
|
||||
- [ ] Assess CVSS score and severity level
|
||||
- [ ] Check if vulnerability affects current stable version
|
||||
- [ ] Check if vulnerability affects LTS versions (if applicable)
|
||||
- [ ] Determine if this requires immediate action or can wait for next release cycle
|
||||
- [ ] Document technical details and root cause
|
||||
|
||||
### Assessment Summary
|
||||
|
||||
- **Severity Level**: `Critical|High|Medium|Low`
|
||||
- **CVSS Score**: `X.X`
|
||||
- **Affects versions**: `X.Y.Z to X.Y.Z`
|
||||
- **Root cause**: Brief technical explanation
|
||||
- **Introduced in commit/version**: `commit-hash` or `vX.Y.Z`
|
||||
- **Attack vector**: `Network|Local|Physical`
|
||||
- **Estimated timeline for fix**: `X days/weeks`
|
||||
|
||||
## Phase 2: Immediate Response & Mitigation
|
||||
|
||||
### Updates
|
||||
|
||||
<< Document immediate actions taken and mitigation strategies >>
|
||||
|
||||
Example:
|
||||
|
||||
Working on hotfix for version X.Y.Z. Temporary workaround available by disabling [feature] in configuration.
|
||||
|
||||
### Tasks
|
||||
|
||||
- [ ] Implement immediate workaround if possible
|
||||
- [ ] Update security advisory draft
|
||||
- [ ] Prepare patch/hotfix
|
||||
- [ ] Test fix thoroughly in development environment
|
||||
- [ ] Prepare updated Docker images and binaries
|
||||
- [ ] Draft security advisory for GitHub Security Advisories
|
||||
- [ ] Consider if coordinated disclosure timeline needs adjustment
|
||||
|
||||
### Mitigation Details
|
||||
|
||||
- **Workaround available**: `Yes|No` - If yes, describe briefly
|
||||
- **Fix implemented on**: `YYYY-MM-DD`
|
||||
- **Patch/hotfix version**: `vX.Y.Z`
|
||||
- **GitHub Security Advisory ID**: `GHSA-XXXX-XXXX-XXXX`
|
||||
|
||||
## Phase 3: Impact Assessment & User Analysis
|
||||
|
||||
### Updates
|
||||
|
||||
<< Analysis of potential impact on the Stalwart deployments >>
|
||||
|
||||
Based on telemetry data and version statistics, approximately X installations may be affected.
|
||||
|
||||
### Tasks
|
||||
|
||||
- [ ] Analyze version adoption from update checks (if available)
|
||||
- [ ] Estimate number of vulnerable installations
|
||||
- [ ] Assess if default configurations are vulnerable
|
||||
- [ ] Review if vulnerability has been exploited (check logs, reports)
|
||||
- [ ] Determine if any user data may have been compromised
|
||||
- [ ] Check for indicators of active exploitation in the wild
|
||||
|
||||
### Analysis Notes
|
||||
|
||||
_Document your impact assessment process and findings_
|
||||
|
||||
### Impact Summary
|
||||
|
||||
- **Estimated vulnerable installations**: `~X out of Y`
|
||||
- **Default configuration vulnerable**: `Yes|No`
|
||||
- **Evidence of exploitation**: `Found|Not found|Unknown`
|
||||
- **User data potentially at risk**: `Email content|Credentials|Configuration|None`
|
||||
- **Confidence in assessment**: `High|Medium|Low`
|
||||
|
||||
## Phase 4: Communication & Release
|
||||
|
||||
### Updates
|
||||
|
||||
<< Communication strategy and release timeline >>
|
||||
|
||||
Security release vX.Y.Z will be published on YYYY-MM-DD with coordinated disclosure.
|
||||
|
||||
### Tasks
|
||||
|
||||
**Pre-release preparation:**
|
||||
|
||||
- [ ] Finalize security patch
|
||||
- [ ] Prepare release notes with security details
|
||||
- [ ] Update documentation if needed
|
||||
- [ ] Test automated update mechanisms
|
||||
- [ ] Prepare GitHub Security Advisory
|
||||
|
||||
**Communication channels:**
|
||||
|
||||
- [ ] Draft announcement for Stalwart community forum/Discord
|
||||
- [ ] Prepare release announcement for GitHub
|
||||
- [ ] Draft security advisory content
|
||||
- [ ] Consider notification to major distributors/packagers
|
||||
|
||||
**Release execution:**
|
||||
|
||||
- [ ] Publish patched version to GitHub releases
|
||||
- [ ] Update Docker images on Docker Hub
|
||||
- [ ] Publish GitHub Security Advisory
|
||||
- [ ] Post to community channels (Discord/forum)
|
||||
- [ ] Update project website/documentation
|
||||
- [ ] Submit CVE request if warranted (CVSS ≥ 4.0)
|
||||
|
||||
**Post-release:**
|
||||
|
||||
- [ ] Monitor community channels for questions
|
||||
- [ ] Track adoption of security update
|
||||
- [ ] Follow up on any additional reports
|
||||
- [ ] Document lessons learned
|
||||
|
||||
### Communication Record
|
||||
|
||||
- **Security release published**: `YYYY-MM-DD HH:MM UTC`
|
||||
- **GitHub Security Advisory**: `GHSA-XXXX-XXXX-XXXX`
|
||||
- **CVE ID** (if applicable): `CVE-YYYY-XXXXX`
|
||||
- **Community announcement**: [Link to forum/Discord post]
|
||||
- **Estimated time to 50% adoption**: `X days/weeks`
|
||||
|
||||
## Post-Incident Review
|
||||
|
||||
### What went well?
|
||||
-
|
||||
|
||||
### What could be improved?
|
||||
-
|
||||
|
||||
### Action items for future incidents:
|
||||
- [ ]
|
||||
- [ ]
|
||||
- [ ]
|
||||
|
||||
### Process improvements:
|
||||
- [ ]
|
||||
- [ ]
|
||||
|
||||
## Emergency Contacts
|
||||
- **Primary maintainer**: hello@stalw.art
|
||||
Reference in New Issue
Block a user