Security/B2G/VulnerabilityManagement

Definition of a security bug

In Bugzilla we define security bugs as having both

1. Classification is Client Software OR Components
2. Keywords contain sec- OR Group contains core-security

Bugzilla searches

Firefox OS 2.2

Bug status clarification phase

The objective of this phase is to find all relevant security bugs and have them

• have a sec-low/moderate/high/critical rating
• categorized in correct components, preferably in ones supporting status-b2g-*
• have status-b2g-v2.2 set
• have [b2g-adv-main2.2*] set if status-b2g-* flags unavailable

Sec-Fixed-Since B2G 2.1

This search contains all critical/high/moderate/other as well af core-security group security bugs last resolved after 2014-11-21 (after 2.1 went code complete) with resolution FIXED. It is meant to define the superset of bugs that may be relevant for the 2.2 release. It also contains products and components that can't have status-b2g-* tracking flags that may have to be moved, cloned, or split to components that can.

This list is meant to serve as an overview for spotting bugs that may have improper security rating or component/product association.

Sec-Status-Needed B2G 2.2

This search lists all security bugs fixed since 2.1 lacking status-b2g-v2.2 classification, and without [b2g-adv-*] tagging on the whiteboard.

This list should ideally be empty, either by setting status-b2g-v2.2 or adding a whiteboard tag for all the bugs it contains.

Sec-Status-Requested B2G 2.2

This search lists all security bugs with status-b2g-v2.2 set to ? or containing [b2g-adv-main2.2?] on the whiteboard. It is meant to signal that the developer was sent a NEEDINFO request for setting the appropriate status-b2g-v2.2, or that we still need some form of security clarification.

Ideally this list will be empty.

Advisory selection phase

The objective of this phase is to sort all relevant security bugs known to affect 2.2 into either

• requiring an advisory, tagging them [b2g-adv-main2.2+]
• requiring no advisory, tagging them [b2g-adv-main2.2-]
• already having an advisory done by Firefox Sec ([adv-*+])

Sec-Affects B2G 2.2

This is the list with all security bugs that have status-b2g-v2.2 set to affected, verified or fixed, or has a [b2g-adv-main2.2*] tag on the whiteboard. It is intended as superset for advisory candidates for the 2.2 release.

Sec-Advisory-Undecided B2G 2.2

These are all security bugs rated high or critical and affecting 2.2, but without an [adv-*+], [bg2-adv-man2.2+] or [bg2-adv-man2.2-] tag on whiteboard.

This list is the main focus for our work. If bugs that need advisory decision don't appear here at some point, we will likely miss them.

This list ideally is empty.

Sec-Has-Advisory B2G 2.2

These are all bugs with [b2g-adv-main2.2+] on the whiteboard, or with affected, fixed, or verified in status-b2g-v2.2 and any of the [adv-*+] tags, meaning that the Firefox sec team provides an advisory that we just need to refer to.

Pay special attention to bugs that have status-b2g-v2.2 set to affected. Make sure they're all at least fixed.

This Bugzilla query is intended to be used for automatic generation of the advisory overview for the Firefox 2.2 release.

Whiteboard keywords

Firefox

Al Billings uses the [adv-*] tag space to declare advisory status for Firefox releases. Tags ending in +] will get an advisory, those ending in -] will not get an advisory. Generally, when there's already an [adv- tag, we don't need to care about creating an advisory for b2g, because either its already there and we must only collect it for our overview, or b2g (most likely) won't require one either.

All Firefox advisory tags are supposed to match either regular expression:

\[adv-[a-zA-Z0-9_.]*\+]
\[adv-[a-zA-Z0-9_.]*\-]

B2G

For Firefox OS we use [b2g-adv-*] tag space, but otherwise same principles as with Firefox, but Al kindly asks not to pollute his [adv-* space.

All B2G advisory tags are supposed to match either regular expression:

\[b2g-adv-[a-zA-Z0-9_.]*\+]  # an advisory is or will be written
\[b2g-adv-[a-zA-Z0-9_.]*-]  # no advisory
\[b2g-adv-[a-zA-Z0-9_.]*?]  # advisory or bug status needs clarification

Tags dedicated to our main 2.2 release: [b2g-adv-main2.2*]

Links

• Security_Severity_Ratings