Difference between revisions of "Moodle security procedures"

Jump to: navigation, search
(Adding link to security development process)
(Adding email for security issues.)
Line 11: Line 11:
 
==How can I report a  security issue?==
 
==How can I report a  security issue?==
  
Please "[http://tracker.moodle.org/secure/CreateIssue.jspa Create a new issue]" in the Moodle tracker describing the problem (and solution if possible) in detail. Make sure you set the security level accurately to make sure that the security team sees it. Bugs classified as a "Serious security issue" are hidden from everyone apart from the security team and the person who reported the problem.
+
Please "[http://tracker.moodle.org/secure/CreateIssue.jspa Create a new issue]" in the Moodle Tracker describing the problem (and solution if possible) in detail. Make sure you set the security level accurately to make sure that the security team sees it. Bugs classified as a "Serious security issue" are hidden from everyone apart from the security team and the person who reported the problem. If you are not sure whether an issue is a security issue, you should still create a new issue in the tracker for review, using the security level "Could be a security issue".
  
If you are not sure whether an issue is a security issue, you should still create a new issue in the tracker for review, using the security level "Could be a security issue".
+
If you are not able to create an issue on the Moodle Tracker, you may send an email to security@moodle.org, however this is less secure than using the Tracker.
  
 
Please do ''not'' post about security issues in the forums on moodle.org or elsewhere. This will cause the issue to be more widely known before a fix can be prepared.
 
Please do ''not'' post about security issues in the forums on moodle.org or elsewhere. This will cause the issue to be more widely known before a fix can be prepared.
Line 20: Line 20:
  
 
# The security team reviews the issue and evaluates its potential impact on all supported versions of Moodle.
 
# The security team reviews the issue and evaluates its potential impact on all supported versions of Moodle.
# The security team works with the issue reporter to resolve the problem, keeping details of the problem and its solution hidden until a release is made.
+
# The security team works with the issue reporter to resolve the problem, following the [[:dev:Process#Security_issues|Security issue development process]] and keeping details of the problem and its solution hidden until a release is made.
 
# New versions are created and tested.
 
# New versions are created and tested.
 
# New packages are created and made available on download.moodle.org.
 
# New packages are created and made available on download.moodle.org.

Revision as of 04:05, 20 June 2014


We treat security issues in Moodle software very seriously. Even though we dedicate a lot of time designing our code to avoid such problems, it is inevitable in a project of this size that new vulnerabilities will occasionally be discovered.

Disclosure policy

We practice responsible disclosure, which means we have a policy of disclosing all security issues that come to our attention, but only after we have solved the issue and given registered Moodle sites time to upgrade or patch their installations.

We ask that when reporting a security issue, you observe these same guidelines, and beyond communicating with the security team, do not share your knowledge of security issues with the public at large.

How can I report a security issue?

Please "Create a new issue" in the Moodle Tracker describing the problem (and solution if possible) in detail. Make sure you set the security level accurately to make sure that the security team sees it. Bugs classified as a "Serious security issue" are hidden from everyone apart from the security team and the person who reported the problem. If you are not sure whether an issue is a security issue, you should still create a new issue in the tracker for review, using the security level "Could be a security issue".

If you are not able to create an issue on the Moodle Tracker, you may send an email to security@moodle.org, however this is less secure than using the Tracker.

Please do not post about security issues in the forums on moodle.org or elsewhere. This will cause the issue to be more widely known before a fix can be prepared.

How we deal with a reported security issue

  1. The security team reviews the issue and evaluates its potential impact on all supported versions of Moodle.
  2. The security team works with the issue reporter to resolve the problem, following the Security issue development process and keeping details of the problem and its solution hidden until a release is made.
  3. New versions are created and tested.
  4. New packages are created and made available on download.moodle.org.
  5. Advisories are mailed to administrators of registered Moodle sites, giving a period of time when they can upgrade before the issue becomes public.
  6. A public announcement is made about the security issue in the Moodle security news forum.

See also...