From: Petr Špaček <pspacek@isc.org>
Date: Wed, 12 Aug 2026 16:05:45 +0000 (+0200)
Subject: Extend CVE checklist
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a5344c3bce28e44ead9613193245da6e5c999f7c;p=thirdparty%2Fbind9.git

Extend CVE checklist

Add also steps from In Case of Emergency document which should have been
performed before we even created the checklist.
---

diff --git a/.gitlab/issue_templates/Internal_use_only-CVE.md b/.gitlab/issue_templates/Internal_use_only-CVE.md
index 75aac2933d9..2912ee68b25 100644
--- a/.gitlab/issue_templates/Internal_use_only-CVE.md
+++ b/.gitlab/issue_templates/Internal_use_only-CVE.md
@@ -36,11 +36,17 @@ confidential!
 
 ## CVE Checklist
 
-### Before Code Freeze
+### ASAP
 
+  - [ ] [:grey_question:][step_emergency]         **(SwEng)** Consider invoking the emergency procedures
+  - [ ] [:grey_question:][step_oper_notification] **(SwEng)** Consider if we need Operational Notification
+  - [ ] [:grey_question:][step_zulip]             **(SwEng)** Create a dedicated Zulip Topic
   - [ ] [:grey_question:][step_respond]           **(SwEng)** Respond to the bug reporter
   - [ ] [:grey_question:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
   - [ ] [:grey_question:][step_coordinate_cve_id] **(SwEng)** Check if we need to coordinate with other vendors (an industry-wide CVE identifier might be necessary)
+
+### Before Code Freeze
+
   - [ ] [:grey_question:][step_assign_cve_id]     **(SwEng)** Assign a CVE identifier, and update the GitLab Issue with it
   - [ ] [:grey_question:][step_note_cve_info]     **(SwEng)** Determine CVSS score and CWE category, and update the GitLab Issue with them
   - [ ] [:grey_question:][step_versions_affected] **(SwEng)** Determine product branches/versions affected
@@ -94,6 +100,9 @@ confidential!
   - [ ] [:grey_question:][step_customers]         **(Marketing)** Ensure that a ticket has been sent in the appropriate announce queue in RT to notify customers that the release is published (as outlined in the release checklist)
 
 [step_incident_manager]:  https://gitlab.isc.org/isc-private/bind9/-/wikis/Initial-Handling-of-(Potential)-Security-Issues
+[step_emergency]:         https://gitlab.isc.org/isc-private/bind9/-/wikis/In-Case-of-Emergency
+[step_oper_notification]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#consider-if-we-need-operational-notification
+[step_zulip]:             https://gitlab.isc.org/isc-private/bind9/-/wikis/In-Case-of-Emergency#create-a-dedicated-zulip-topic
 [step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
 [step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
 [step_coordinate_cve_id]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#check-if-we-need-to-coordinate-with-other-vendors-an-industry-wide-cve-identifier-might-be-necessary