monero-project/meta
monero-project/meta
1
0
Fork 0
mirror of https://github.com/monero-project/meta.git synced 2024-12-22 11:39:22 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #312 from anonimal/VRP-DoS

Browse source 
VRP: specify type of DoS in relation to reward
This commit is contained in:
luigi1111 2019-04-30 16:09:19 -05:00 committed by GitHub
commit b923a6fb11
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 7 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
VULNERABILITY_RESPONSE_PROCESS.md
View file

@ -83,11 +83,13 @@ PGP fingerprint = 1218 6272 CD48 E253 9E2D D29B 66A7 6ECF 9144 09F1
5. If over email, Response Manager opens a HackerOne issue for new submission 5. If over email, Response Manager opens a HackerOne issue for new submission
6. Establish severity of vulnerability: 6. Define severity:
- a. HIGH: impacts network as a whole, has potential to break entire monero/kovri network, results in the loss of monero, or is on a scale of great catastrophe - a. Establish severity of vulnerability:
- b. MEDIUM: impacts individual nodes, routers, wallets, or must be carefully exploited - i. HIGH: impacts network as a whole, has potential to break entire monero/kovri network, results in the loss of monero, or is on a scale of great catastrophe
- c. LOW: is not easily exploitable or is low impact - ii. MEDIUM: impacts individual nodes, routers, wallets, or must be carefully exploited
- d. If there are any disputes regarding bug severity, the Monero Response team will ultimately define bug severity - iii. LOW: is not easily exploitable or is low impact
- b. If there are any disputes regarding bug severity, the Monero Response team will ultimately define bug severity
- c. Since a systematic DoS hunt has not been completed on any code, DoS's which do not crash a node remotely will receive a lower bounty reward
7. Respond according to the severity of the vulnerability: 7. Respond according to the severity of the vulnerability:
- a. HIGH severities must be notified on website and reddit /r/Monero (/r/Kovri for kovri) within 3 working days of classification - a. HIGH severities must be notified on website and reddit /r/Monero (/r/Kovri for kovri) within 3 working days of classification