The repository's own .github, now that it is public
SPEC 2.2a says INBUXA writes its own when the repository is first published, and it is. Until now the public repository carried Stalwart's: a security policy telling people to report vulnerabilities to Stalwart Labs, and a contributing guide whose policy is that pull requests from anyone not on upstream's vouched list are closed automatically. Neither is this project's, and both were being offered to anyone who looked. So: a security policy that says where to send a report, and what happens if it turns out to be upstream's bug rather than ours; a contributing guide that says what a fork of someone else's code needs from a contributor, including the clean-room question, since the record has to stay true; the Contributor Covenant; and a sponsor link. Upstream's two security documents move to .github-upstream/ beside its workflows -- kept, not used, not presented as ours. CI builds the server and compiles every test target, and deliberately runs no suite. The unit tests only build with the integration crate in the graph, and the integration suites want a STORE, fixed ports and a container apiece, so running them here would mean a tick that skipped everything or a cross that means "the runner has no Redis". The workflow says as much, so nobody has to rediscover it. Also ignores /artifact: two hand-built binaries, ~190 MB, one `git add -A` away from a public repository.
This commit is contained in:
@@ -0,0 +1,173 @@
|
||||
# Stalwart Security Incident Response Checklist
|
||||
|
||||
## Phase 1 : Initial Assessment & Validation
|
||||
|
||||
### Updates
|
||||
|
||||
<< Use this section to detail the report received, initial assessment, and validation results >>
|
||||
|
||||
Example:
|
||||
|
||||
I've reviewed the security report and confirmed this vulnerability exists in Stalwart version X.Y.Z.
|
||||
|
||||
Assessment of exploitability:
|
||||
|
||||
- Attack complexity: [High/Medium/Low]
|
||||
- Prerequisites: [Authentication required/Network access/Specific configuration/etc.]
|
||||
- User interaction required: [Yes/No]
|
||||
|
||||
Potential impact:
|
||||
- Email data confidentiality: [At risk/Not affected]
|
||||
- Server integrity: [At risk/Not affected]
|
||||
- Service availability: [At risk/Not affected]
|
||||
- Estimated affected installations: [Number/Percentage]
|
||||
|
||||
### Resources
|
||||
|
||||
- [Stalwart Security Policy](https://github.com/stalwartlabs/stalwart/blob/main/SECURITY.md)
|
||||
- [CVE Scoring Calculator](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator)
|
||||
- [Rust Security Advisory Database](https://rustsec.org/)
|
||||
|
||||
### Tasks
|
||||
|
||||
- [ ] Reproduce the vulnerability in test environment
|
||||
- [ ] Assess CVSS score and severity level
|
||||
- [ ] Check if vulnerability affects current stable version
|
||||
- [ ] Check if vulnerability affects LTS versions (if applicable)
|
||||
- [ ] Determine if this requires immediate action or can wait for next release cycle
|
||||
- [ ] Document technical details and root cause
|
||||
|
||||
### Assessment Summary
|
||||
|
||||
- **Severity Level**: `Critical|High|Medium|Low`
|
||||
- **CVSS Score**: `X.X`
|
||||
- **Affects versions**: `X.Y.Z to X.Y.Z`
|
||||
- **Root cause**: Brief technical explanation
|
||||
- **Introduced in commit/version**: `commit-hash` or `vX.Y.Z`
|
||||
- **Attack vector**: `Network|Local|Physical`
|
||||
- **Estimated timeline for fix**: `X days/weeks`
|
||||
|
||||
## Phase 2: Immediate Response & Mitigation
|
||||
|
||||
### Updates
|
||||
|
||||
<< Document immediate actions taken and mitigation strategies >>
|
||||
|
||||
Example:
|
||||
|
||||
Working on hotfix for version X.Y.Z. Temporary workaround available by disabling [feature] in configuration.
|
||||
|
||||
### Tasks
|
||||
|
||||
- [ ] Implement immediate workaround if possible
|
||||
- [ ] Update security advisory draft
|
||||
- [ ] Prepare patch/hotfix
|
||||
- [ ] Test fix thoroughly in development environment
|
||||
- [ ] Prepare updated Docker images and binaries
|
||||
- [ ] Draft security advisory for GitHub Security Advisories
|
||||
- [ ] Consider if coordinated disclosure timeline needs adjustment
|
||||
|
||||
### Mitigation Details
|
||||
|
||||
- **Workaround available**: `Yes|No` - If yes, describe briefly
|
||||
- **Fix implemented on**: `YYYY-MM-DD`
|
||||
- **Patch/hotfix version**: `vX.Y.Z`
|
||||
- **GitHub Security Advisory ID**: `GHSA-XXXX-XXXX-XXXX`
|
||||
|
||||
## Phase 3: Impact Assessment & User Analysis
|
||||
|
||||
### Updates
|
||||
|
||||
<< Analysis of potential impact on the Stalwart deployments >>
|
||||
|
||||
Based on telemetry data and version statistics, approximately X installations may be affected.
|
||||
|
||||
### Tasks
|
||||
|
||||
- [ ] Analyze version adoption from update checks (if available)
|
||||
- [ ] Estimate number of vulnerable installations
|
||||
- [ ] Assess if default configurations are vulnerable
|
||||
- [ ] Review if vulnerability has been exploited (check logs, reports)
|
||||
- [ ] Determine if any user data may have been compromised
|
||||
- [ ] Check for indicators of active exploitation in the wild
|
||||
|
||||
### Analysis Notes
|
||||
|
||||
_Document your impact assessment process and findings_
|
||||
|
||||
### Impact Summary
|
||||
|
||||
- **Estimated vulnerable installations**: `~X out of Y`
|
||||
- **Default configuration vulnerable**: `Yes|No`
|
||||
- **Evidence of exploitation**: `Found|Not found|Unknown`
|
||||
- **User data potentially at risk**: `Email content|Credentials|Configuration|None`
|
||||
- **Confidence in assessment**: `High|Medium|Low`
|
||||
|
||||
## Phase 4: Communication & Release
|
||||
|
||||
### Updates
|
||||
|
||||
<< Communication strategy and release timeline >>
|
||||
|
||||
Security release vX.Y.Z will be published on YYYY-MM-DD with coordinated disclosure.
|
||||
|
||||
### Tasks
|
||||
|
||||
**Pre-release preparation:**
|
||||
|
||||
- [ ] Finalize security patch
|
||||
- [ ] Prepare release notes with security details
|
||||
- [ ] Update documentation if needed
|
||||
- [ ] Test automated update mechanisms
|
||||
- [ ] Prepare GitHub Security Advisory
|
||||
|
||||
**Communication channels:**
|
||||
|
||||
- [ ] Draft announcement for Stalwart community forum/Discord
|
||||
- [ ] Prepare release announcement for GitHub
|
||||
- [ ] Draft security advisory content
|
||||
- [ ] Consider notification to major distributors/packagers
|
||||
|
||||
**Release execution:**
|
||||
|
||||
- [ ] Publish patched version to GitHub releases
|
||||
- [ ] Update Docker images on Docker Hub
|
||||
- [ ] Publish GitHub Security Advisory
|
||||
- [ ] Post to community channels (Discord/forum)
|
||||
- [ ] Update project website/documentation
|
||||
- [ ] Submit CVE request if warranted (CVSS ≥ 4.0)
|
||||
|
||||
**Post-release:**
|
||||
|
||||
- [ ] Monitor community channels for questions
|
||||
- [ ] Track adoption of security update
|
||||
- [ ] Follow up on any additional reports
|
||||
- [ ] Document lessons learned
|
||||
|
||||
### Communication Record
|
||||
|
||||
- **Security release published**: `YYYY-MM-DD HH:MM UTC`
|
||||
- **GitHub Security Advisory**: `GHSA-XXXX-XXXX-XXXX`
|
||||
- **CVE ID** (if applicable): `CVE-YYYY-XXXXX`
|
||||
- **Community announcement**: [Link to forum/Discord post]
|
||||
- **Estimated time to 50% adoption**: `X days/weeks`
|
||||
|
||||
## Post-Incident Review
|
||||
|
||||
### What went well?
|
||||
-
|
||||
|
||||
### What could be improved?
|
||||
-
|
||||
|
||||
### Action items for future incidents:
|
||||
- [ ]
|
||||
- [ ]
|
||||
- [ ]
|
||||
|
||||
### Process improvements:
|
||||
- [ ]
|
||||
- [ ]
|
||||
|
||||
## Emergency Contacts
|
||||
- **Primary maintainer**: hello@stalw.art
|
||||
@@ -0,0 +1,135 @@
|
||||
# Stalwart Security Advisory
|
||||
|
||||
**CVE ID:** CVE-YYYY-NNNNN
|
||||
**Publication Date:** YYYY-MM-DD
|
||||
**Last Updated:** YYYY-MM-DD
|
||||
|
||||
## Summary
|
||||
|
||||
[Provide a brief, non-technical summary of the vulnerability in 1-2 sentences]
|
||||
|
||||
## Affected Products and Versions
|
||||
|
||||
**Product:** Stalwart Mail and Collaboration Server
|
||||
|
||||
**Affected Versions:**
|
||||
- Version X.X.X through Y.Y.Y
|
||||
- [List specific affected version ranges]
|
||||
|
||||
**Fixed Versions:**
|
||||
- Version Z.Z.Z and later
|
||||
- [List all versions that include the fix]
|
||||
|
||||
## Vulnerability Details
|
||||
|
||||
### Description
|
||||
|
||||
[Detailed technical description of the vulnerability, including how it can be exploited]
|
||||
|
||||
### Impact
|
||||
|
||||
[Describe the potential impact if this vulnerability is exploited]
|
||||
|
||||
### CVSS Score
|
||||
|
||||
**CVSS v3.1 Base Score:** X.X ([SEVERITY])
|
||||
**Vector String:** CVSS:3.1/AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X
|
||||
|
||||
**Severity Breakdown:**
|
||||
- **Attack Vector:** [Network/Adjacent/Local/Physical]
|
||||
- **Attack Complexity:** [Low/High]
|
||||
- **Privileges Required:** [None/Low/High]
|
||||
- **User Interaction:** [None/Required]
|
||||
- **Scope:** [Unchanged/Changed]
|
||||
- **Confidentiality Impact:** [None/Low/High]
|
||||
- **Integrity Impact:** [None/Low/High]
|
||||
- **Availability Impact:** [None/Low/High]
|
||||
|
||||
### CWE Classification
|
||||
|
||||
**CWE-XXX:** [Weakness Name]
|
||||
|
||||
## Technical Details
|
||||
|
||||
### Root Cause
|
||||
|
||||
[Explain the underlying cause of the vulnerability]
|
||||
|
||||
### Attack Scenario
|
||||
|
||||
[Describe a realistic attack scenario or proof of concept, without providing exploit code]
|
||||
|
||||
### Prerequisites
|
||||
|
||||
[List any conditions that must be met for successful exploitation]
|
||||
|
||||
## Remediation
|
||||
|
||||
### Recommended Actions
|
||||
|
||||
1. **Immediate:** Upgrade to version Z.Z.Z or later
|
||||
2. **Short-term:** [Any temporary mitigation measures]
|
||||
3. **Long-term:** [Any additional security hardening recommendations]
|
||||
|
||||
### Upgrade Instructions
|
||||
|
||||
```bash
|
||||
# Example upgrade commands
|
||||
[Provide specific upgrade instructions for Stalwart]
|
||||
```
|
||||
|
||||
### Workarounds
|
||||
|
||||
[If applicable, describe any temporary workarounds for systems that cannot be immediately upgraded]
|
||||
|
||||
**Note:** Workarounds are temporary measures and do not fully resolve the vulnerability. Upgrading is strongly recommended.
|
||||
|
||||
## Detection
|
||||
|
||||
### Indicators of Compromise
|
||||
|
||||
[List any logs, patterns, or indicators that may suggest exploitation attempts]
|
||||
|
||||
### Log Entries
|
||||
|
||||
```
|
||||
[Example log entries that administrators should look for]
|
||||
```
|
||||
|
||||
## Timeline
|
||||
|
||||
- **YYYY-MM-DD:** Vulnerability discovered [by researcher/team name]
|
||||
- **YYYY-MM-DD:** Vendor notified
|
||||
- **YYYY-MM-DD:** Vendor acknowledged issue
|
||||
- **YYYY-MM-DD:** Fix developed and tested
|
||||
- **YYYY-MM-DD:** Fixed version released
|
||||
- **YYYY-MM-DD:** Public disclosure
|
||||
|
||||
## Credits
|
||||
|
||||
This vulnerability was discovered by [Researcher Name / Organization].
|
||||
|
||||
## References
|
||||
|
||||
- Stalwart Mail Server: https://stalw.art/
|
||||
- CVE Entry: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-YYYY-NNNNN
|
||||
- GitHub Advisory: [Link to GitHub Security Advisory if applicable]
|
||||
- Release Notes: [Link to release notes with fix]
|
||||
|
||||
## Contact Information
|
||||
|
||||
For questions or concerns regarding this advisory, please contact:
|
||||
|
||||
**Security Team:** hello@stalw.art
|
||||
**Website:** https://stalw.art
|
||||
|
||||
To report security vulnerabilities in Stalwart, please follow our [responsible disclosure policy](https://github.com/stalwartlabs/stalwart/security/policy).
|
||||
|
||||
## Disclaimer
|
||||
|
||||
This advisory is provided "as is" without warranty of any kind. The information contained in this advisory is subject to change without notice.
|
||||
|
||||
---
|
||||
|
||||
**Document Version:** 1.0
|
||||
**Classification:** Public
|
||||
Reference in New Issue
Block a user