Suggestion: Marking of commits that fix vulnerabilities #7456

issue rebroad opened this issue on February 1, 2016

rebroad commented at 4:14 PM on February 1, 2016: contributor

I've seen discussions where forks of the bitcoin code is missing important fixes to vulnerabilities, and I'm wondering if it can be made more obvious which commits are the important ones. Can this be addressed?
MarcoFalke commented at 4:22 PM on February 1, 2016: member

What about https://github.com/bitcoin/bitcoin/pulls?q=is%3Apr+label%3A%22Priority+High%22+is%3Aclosed
laanwj commented at 5:27 PM on February 1, 2016: member

Not against this, but I don't think this can be practically enforced. Though we could try adding a "security" category and adding it to security-related issues.

(in some pressing cases, there could be reasons to reveal this only after the fact, to prevent widespread abuse of a vulnerability before the fix can be deployed)
laanwj added the label Brainstorming on Feb 1, 2016
luke-jr commented at 7:13 PM on February 1, 2016: member

The ideal way IMO would be to flag the commits on the applicable CVE wiki page. This allows post-hoc addition of the information.
laanwj commented at 9:23 AM on February 4, 2016: member

For critical issues @luke-jr's suggestion is certainly the way to go. This is similar to what other projects do.
MarcoFalke commented at 5:28 PM on April 26, 2020: member

Fixed here: https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures
MarcoFalke closed this on Apr 26, 2020
DrahtBot locked this on Feb 15, 2022

Contributors

Labels