Security advisories
The register of the security advisories of the Nistor open-source project, newest first.
The register of the security advisories of the Nistor open-source project: one entry per fixed vulnerability, newest first. How to report a vulnerability: SECURITY.md.
No advisory has been published yet.
How an advisory is made#
- Report. A vulnerability is reported privately, by mail or in a confidential issue (SECURITY.md). We acknowledge it within 3 working days.
- Triage. We reproduce it on the supported versions and score it with CVSS 4.0.
- Fix. The fix is prepared in confidence (a confidential merge request) and released as a patch version of the latest minor release (versioning). The release pipeline scans the images before it publishes them.
- CVE. For a vulnerability in this project we request a CVE identifier from GitLab, a CVE Numbering Authority for projects hosted on GitLab.com; its details are published when the fix is.
- Advisory. On the release day: an entry below, the advisory in the release notes, and the reporter credited if they wish.
Entry format#
Each entry is a level-2 heading NISTOR-YYYY-NNN: <short title> followed by:
| Field | Content |
|---|---|
| CVE | the CVE identifier, or "none" |
| Severity | Critical, High, Medium or Low, with the CVSS 4.0 vector |
| Affected | the affected versions, and which artefacts (Python packages, images) |
| Fixed | the first fixed version |
| Description | what an attacker could do, without exploit code |
| Workaround | if any, before upgrading |
| Credit | the reporter, if they wish to be named |
| Published | the date (YYYY-MM-DD) |