mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-08-01 21:23:51 -09:00
dbdc45e9b0
As of today, the Buildroot project is now 100% compliant with OpenSSF Best Practices self-assesment. Let's therefore advertise this in our SECURITY.md and in the footer of the website. Signed-off-by: Titouan Christophe <titouan.christophe@mind.be> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
39 lines
1.6 KiB
Markdown
39 lines
1.6 KiB
Markdown
# Security Policy
|
|
|
|
[](https://www.bestpractices.dev/projects/12245)
|
|
|
|
## Security advisories
|
|
|
|
Advisories for Buildroot security vulnerabilities are reported on the
|
|
developer's mailing list. A public archive can be consulted on
|
|
https://lists.buildroot.org/mailman/listinfo/buildroot
|
|
|
|
Buildroot itself has a CPE to track its published vulnerabilities:
|
|
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=buildroot
|
|
|
|
The Buildroot project provides some ways for its users to track known
|
|
vulnerabilites in the packages included in the generated images, see:
|
|
- https://nightly.buildroot.org/manual.html#_details_about_packages
|
|
|
|
In addition, detailed informations for all packages integrated with Buildroot
|
|
are updated daily on the following public web pages:
|
|
- https://security.buildroot.org/
|
|
- https://autobuild.buildroot.org/stats/
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
To report a security vulnerability found in the Buildroot build system itself,
|
|
please send an email to [security@buildroot.org](mailto:security@buildroot.org).
|
|
|
|
This is a private mailing list contacting the Buildroot maintainers only.
|
|
|
|
## Vulnerabilities in packages
|
|
|
|
Buildroot is a build system that cross-compiles packages from third-party
|
|
sources. The Buildroot developers are not responsible for security
|
|
vulnerabilities in these packages. Such vulnerabilities should be reported
|
|
directly to the upstream project that maintains the affected package.
|
|
|
|
When vulnerabilities are fixed upstream, send a patch to update the affected
|
|
packages in Buildroot.
|