From: George Joseph Date: Tue, 4 Aug 2026 11:57:17 +0000 (-0600) Subject: SECURITY.md: Add warning about reporting multiple issues in one advisory. X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b531f71b128a195c1ee367ec7438cbcec73b09ac;p=thirdparty%2Fasterisk.git SECURITY.md: Add warning about reporting multiple issues in one advisory. --- diff --git a/SECURITY.md b/SECURITY.md index 04562a4c92..684f905065 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -19,7 +19,18 @@ page on the [documentation website](https://docs.asterisk.org) then use the tab of this project's GitHub repository. **Never use regular GitHub issues to report security vulnerabilities!** -##### Do NOT use the "Start a temporary private fork" security advisory feature! +#### Please report only one vulnerability per security advisory! + +Reporting multiple vulnerability in one advisory creates the following issues: + +* They'll probably need different CVEs. +* They may have different Common Weakness Enumerator (CWE) values. While you can list multiple CWEs in a single advisory, you can't indicate which vulnerability has which weakness. +* They may have different severities. +* They may affect different Asterisk versions. +* It makes it harder to associate fix pull requests to a vulnerability. +* It makes it harder for our automation tasks to to validate fixes and create releases. + +#### Do NOT use the "Start a temporary private fork" security advisory feature! Private forks created from security advisories are severly limited by GitHub and cannot run the workflows necessary for validation and testing. Once an