Author: angela
Date: Wed Jan 29 10:29:18 2020
New Revision: 1873295
URL: http://svn.apache.org/viewvc?rev=1873295&view=rev
Log:
OAK-8881 : Add section 'security reports' to the oak docu
Added:
jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/reports.md
Modified:
jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/overview.md
Modified: jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/overview.md
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/overview.md?rev=1873295&r1=1873294&r2=1873295&view=diff
==============================================================================
--- jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/overview.md
(original)
+++ jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/overview.md Wed Jan
29 10:29:18 2020
@@ -21,6 +21,7 @@ The Oak Security Layer
### General
* [Introduction to Oak Security](introduction.html)
+ * [Security Reports](reports.html)
### Authentication
Added: jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/reports.md
URL:
http://svn.apache.org/viewvc/jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/reports.md?rev=1873295&view=auto
==============================================================================
--- jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/reports.md (added)
+++ jackrabbit/oak/trunk/oak-doc/src/site/markdown/security/reports.md Wed Jan
29 10:29:18 2020
@@ -0,0 +1,52 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ -->
+
+Security Reports
+--------------------------------------------------------------------------------
+
+### Security Updates
+
+Please note that binary patches are not produced for individual
vulnerabilities. To obtain the fix for a particular
+vulnerability you should upgrade to the officially released version where that
vulnerability has been fixed.
+
+#### List of Vulnerabilities
+
+Note: the vulnerability reports linked below will provide additional details
including reference to the public
+announcement and a short description.
+
+| CVE Number | Type | Fix
Versions |
+|---------------|--------------------------------------------------|-----------------------------------------------------------------|
+|[CVE-2020-1940]| Sensitive information disclosure vulnerability | 1.24.0,
1.10.8, 1.8.2, patches for 1.6, 1.4, 1.2 see [OAK-8870] |
+| | |
+
+### Reporting Vulnerabilities with Apache Jackrabbit Oak
+
+The Apache Software Foundation takes an active stance in eliminating security
problems. We strongly encourage everyone
+to report vulnerabilities to the Apache security mailing list
_security(at)apache.org_, before disclosing them in a public forum.
+
+Please note that the security mailing list should only be used for reporting
undisclosed vulnerabilities and
+managing the process of fixing them. We cannot accept regular bug reports or
other queries at this address. If you wish
+to report a bug that isn't an undisclosed security vulnerability, please use
[https://issues.apache.org/jira/projects/OAK/issues](https://issues.apache.org/jira/projects/OAK/issues).
+
+###Errors and Omissions
+
+Please report any errors or omissions to _security(at)apache.org_.
+
+
+<!-- hidden references -->
+[CVE-2020-1940]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1940
+[OAK-8870]:
https://issues.apache.org/jira/browse/OAK-8870?focusedCommentId=17025637&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-17025637
\ No newline at end of file
