Towards a Vulnerability Reporting Specification
summary
A minimal, CRA-focused vulnerability reporting specification targets clear, auditable requirements rather than guidance prose: a two-page draft lists concrete musts — have a vulnerability handling process, accept reports without separate accounts, adopt coordinated vulnerability disclosure, must: publish all resolved vulnerabilities — and requires naming a responsible person/group and reporting upstream. Draft lives in an open OC working-group GitHub repo under an open-source license, aims for RC1 by end of April and to feed EU attestation and harmonized standards.
AI-written summary · about
chapters (9)
- 0:00Welcome
- 1:49Eclipse security initiatives
- 3:57Vulnerability management purpose
- 6:28Why existing standards fail
- 8:33Five main goals
- 10:42Drafting approach
- 12:12Draft status and availability
- 14:24Timeline and regulations
- 16:33Q&A
related talks
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
54mThe CRA, Where Are We Six Months After Its Approval
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors
44mA Researcher Centric Approach to Coordinated Vulnerability Disclosure
18mWhat You Need to Know and Do about Vulnerability Disclosure
58mPanel Discussion - The Risks of Requiring Premature Vulnerability Disclosures
48mHow to report a vulnerability: Responsible Disclosure for Developers