Skip to content

vulnerability-handling-process.md

Latest commit

 

History

History
95 lines (79 loc) · 5.67 KB

vulnerability-handling-process.md

File metadata and controls

95 lines (79 loc) · 5.67 KB
Raw

Vulnerability handling process — wolfSSL Inc.

Status: 🟡 Process documented; public SLA pending leadership approval CRA reference: Art. 13 (vulnerability handling), Art. 14 (active-exploitation reporting)

Discovery → report → triage → fix → disclosure

            ┌────────────────────────┐
            │ External report        │
            │  · security.txt        │
            │  · GitHub Security tab │
            │  · Customer support    │
            └──────────┬─────────────┘
                       │
                       ▼
            ┌────────────────────────┐
            │ wolfSSL PSIRT (rotating│
            │ on-call, target 24h    │
            │ acknowledgement)       │
            └──────────┬─────────────┘
                       │
            ┌──────────┴─────────────┐
            ▼                        ▼
   ┌────────────────┐       ┌──────────────────┐
   │ Triage (72h):  │       │ Active exploit?  │
   │ severity, CVSS,│ ────▶ │ Yes ─▶ ENISA 24h │
   │ scope, fix plan│       │ No  ─▶ standard │
   └────────┬───────┘       └──────────────────┘
            │
            ▼
   ┌────────────────┐
   │ Fix + advisory │
   │ (CVE assigned  │
   │ as CNA)        │
   └────────┬───────┘
            │
            ▼
   ┌────────────────┐
   │ Coordinated    │
   │ disclosure +   │
   │ release        │
   └────────────────┘

Public-facing artefacts

Artefact Location Purpose
security.txt (RFC 9116) /.well-known/security.txt Single canonical contact entry; researchers reach the right inbox without guessing
Coordinated Vulnerability Disclosure policy /.well-known/vulnerability-disclosure-policy.txt How wolfSSL handles reports: scope, expectations, safe-harbor
Security advisories https://www.wolfssl.com/docs/security-vulnerabilities/ Per-CVE narrative, affected versions, mitigations
CVE Numbering Authority wolfSSL is a CNA wolfSSL assigns CVE IDs within the wolfSSL libraries scope

Service-level targets (proposed; pending leadership approval)

Stage Target Notes
Acknowledgement of receipt 24 hours From any channel listed in security.txt. Pending public approval to commit.
Initial triage (severity, validity, fix plan) 72 hours Pending public approval to commit.
ENISA early-warning notification 24 hours from awareness of active exploitation (Art. 14(2)(a)) Hard regulatory deadline — not negotiable.
ENISA follow-up report 72 hours from awareness (Art. 14(2)(b)) Hard regulatory deadline.
ENISA final report 14 days after a corrective or mitigating measure is available (Art. 14(2)(c)) Hard regulatory deadline. Clock runs from fix-availability, not from awareness or CVE publication.
Coordinated public disclosure Typically 90 days from triage; case-by-case Negotiable with reporter.

These targets are not yet publicly committed in the CVD policy. Once the leadership decision is taken, the CVD policy at /.well-known/vulnerability-disclosure-policy.txt will be updated to include them.

On-call coverage

🟠 In progress. Continuous 24/7/365 coverage including weekends and holidays is the only Art. 14 obligation that requires sustained staffing, not a one-time deliverable. Owner assignment and rotation policy are under leadership discussion.

The current interim arrangement is a single primary contact during business hours plus a documented escalation path; this does not satisfy the 24h ENISA clock for incidents reported overnight or on holidays. Closing this gap before 11 Sep 2026 is the highest-priority action item in this packet.

What this means for customers

When you ship a product containing wolfSSL:

  • Your own pillar-4 obligation is independent of ours. You publish your own security.txt, your own CVD policy, run your own on-call. Our process does not satisfy yours.
  • Coordinate on shared advisories. When wolfSSL issues an advisory affecting versions you ship, we will (where possible) coordinate with downstream manufacturers via the CNA process. Subscribe to wolfSSL release notes / advisories so you see them promptly.
  • ENISA reporting is split. wolfSSL Inc. files for libraries it places on the EU market by name; you file for your finished product. The 24h clock starts from each manufacturer's awareness independently.

References