You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Before sending the report, however, please read the following guidelines first. The guidelines should
47
34
answer the most common questions you might have about reporting vulnerabilities.
48
35
49
-
###What should be and should NOT be reported ?
36
+
## What should be and should NOT be reported ?
50
37
51
38
**Only** use the security e-mail address to report undisclosed security vulnerabilities in Apache
52
39
Airflow and to manage the process of fixing such vulnerabilities. We do not accept regular
@@ -61,13 +48,13 @@ with dependencies in Airflow Docker reference image - there is a page that descr
61
48
[Airflow reference Image is fixed at release time](https://airflow.apache.org/docs/docker-stack/index.html#fixing-images-at-release-time) and providing helpful instructions explaining
62
49
how you can build your own image and manage dependencies of Airflow in your own image.
63
50
64
-
###How to report the issue ?
51
+
## How to report the issue ?
65
52
66
53
Please send one plain-text email for each vulnerability you are reporting including an explanation
67
54
of how it affects Airflow security. We may ask that you resubmit your report if you send it as an image,
68
55
movie, HTML, or PDF attachment when you could as easily describe it with plain text.
69
56
70
-
###Is this really a security vulnerability ?
57
+
## Is this really a security vulnerability ?
71
58
72
59
Before reporting vulnerabilities, please make sure to read and understand the [security model](https://airflow.apache.org/docs/apache-airflow/stable/security/security_model.html)
73
60
of Airflow, because some of the potential security vulnerabilities that are valid for projects that are
@@ -85,7 +72,7 @@ a lot of time on preparing the issue report to follow the guidelines above and w
85
72
save time for yourself and for the Airflow Security team by reading and understanding the security model
86
73
before reporting the issue.
87
74
88
-
###How do we assess severity of the issue ?
75
+
## How do we assess severity of the issue ?
89
76
90
77
Severity of the issue is determined based on the criteria described in
91
78
the [Severity Rating blog post](https://security.apache.org/blog/severityrating/) by the Apache Software Foundation Security team.
@@ -95,7 +82,7 @@ do not apply to Airflow, or have a different severity than some generic scoring
95
82
(for example `CVSS`) calculation suggests. So we are not using any generic scoring system.
96
83
97
84
98
-
###What happens after you report the issue ?
85
+
## What happens after you report the issue ?
99
86
100
87
The Airflow Security Team will get back to you after assessing the report. You will usually get
101
88
confirmation that the issue is being worked (or that we quickly assessed it as invalid) within several
@@ -116,7 +103,7 @@ Security issues in Airflow are handled by the Airflow Security Team. Details abo
116
103
Team and how members of it are chosen can be found in the
0 commit comments