The information below, as well as information about past vulnerabilities, can be found at

https://docs.ceph.com/en/latest/security/

Security fixes are applied to the active releases, the stable releases that currently receive backports. For the list of active releases and the estimated end-of-life for each, please refer to

https://docs.ceph.com/en/latest/releases/#active-releases

To report a vulnerability, please send email to security@ceph.io

• Please do not file a public ceph tracker issue for a vulnerability.
• We urge reporters to provide as much information as is practical (a reproducer, versions affected, fix if available, etc.), as this can speed up the process considerably.
• Please let us know to whom credit should be given and with what affiliations.
• If this issue is not yet disclosed publicly and you have any disclosure date in mind, please share the same along with the report.
• If you want the report handled under embargo, with a coordinated release and disclosure, please say so in the report.

You may also open a GitHub security advisory for each vulnerability you report and include its URL in your email. This is especially helpful if you are reporting several vulnerabilities at once.

The full process is documented at

https://docs.ceph.com/en/latest/security/process/

• The report will be acknowledged within three business days.
• The team will investigate and update the email thread with relevant information and may ask for additional information.
• If the team does not confirm the report, no further action will be taken and the issue will be closed.
• If the team confirms the report, it decides whether the issue warrants a CVE and, if so, assigns a CVE identifier and shares it with the reporter.
• Each confirmed vulnerability is handled in one of three tiers, chosen at intake. Severity alone does not determine an embargo.
  • Unembargoed: the vulnerability is already public. The fix follows the normal development and release process and ships in the next applicable release, or in a hotfix if the risk warrants it.
  • Deferred disclosure: the default for vulnerabilities that are not yet public and are rated Low or Medium. The fix is developed in public without identifying it as a vulnerability fix, while the advisory stays private until a release contains the fix, backports for the other active releases are open, and downstream stakeholders have had at least seven days' notice.
  • Embargoed: used when the report came under an external embargo, the reporter requested it, or the Security Lead decides the risk warrants it. The vulnerability and its fix stay private until a coordinated release on an agreed disclosure date, which coincides with a Ceph release containing the fix and is not set on a Friday or during holiday periods.
• Neither deferred disclosure nor an embargo should last more than 90 days from the date of vulnerability confirmation, except under unusual circumstances.
• Downstream stakeholders and vendors receive at least seven days' notice of a planned disclosure through the security email list. Membership can be requested from security@ceph.io.
• If an embargoed vulnerability is unintentionally fixed in the public repository, stakeholders and vendors are notified and given several days to prepare before the public disclosure.
• On the disclosure date the GitHub advisory is published and an announcement is made. The fastest place to receive security announcements is via the ceph-announce@ceph.io or oss-security@lists.openwall.com mailing lists.
• Where the law requires you to notify a CSIRT or ENISA, for example under the EU Cyber Resilience Act, please email the Security Lead at security@ceph.io before making the notification.

If the report is considered embargoed, we ask you to not disclose the vulnerability before it has been fixed and announced, unless you received a response from the Ceph security team that you can do so or the law requires you to. This holds true until the public disclosure date that was agreed upon by the list. Thank you for improving the security of Ceph and its ecosystem. Your efforts and responsible disclosure are greatly appreciated and will be publicly acknowledged by name, unless you prefer to remain anonymous. We do not offer a bug bounty program.