diff --git a/README.md b/README.md index 5af14aace6a1..a96662318f67 100644 --- a/README.md +++ b/README.md @@ -49,7 +49,7 @@ will keep our community secure. If you happen to come across a security issue we you to disclose it to us privately to allow our users and community enough time to upgrade. Security issues will always take precedence over anything else in the pipeline. -For more information on how to disclose a security vulnerability, [please see this page](docs/development/security/README.md). +For more information on how to disclose a security vulnerability, [please see this page](docs/development/[statement-on-security](docs/security-and-privacy/statement-on-security/README.md). ## License diff --git a/SECURITY.md b/SECURITY.md index a7850e2afd0c..abb0dc227922 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1 +1 @@ -Please find our statement on security in this document: https://www.openproject.org/docs/development/security/ +Please find our statement on security in this document: https://www.openproject.org/docs/security-and-privacy/statement-on-security/ diff --git a/docs/enterprise-guide/enterprise-cloud-guide/gdpr-compliance/README.md b/docs/enterprise-guide/enterprise-cloud-guide/gdpr-compliance/README.md index ba400711fe16..9cbd17f7aad7 100644 --- a/docs/enterprise-guide/enterprise-cloud-guide/gdpr-compliance/README.md +++ b/docs/enterprise-guide/enterprise-cloud-guide/gdpr-compliance/README.md @@ -73,4 +73,4 @@ Please navigate to -> Administration -> GDPR and you can now online review and s -Find out more about [OpenProject's security features](../../../development/security/#openproject-security-features). +Find out more about [OpenProject's security features](../../../security-and-privacy/statement-on-security/#openproject-security-features). diff --git a/docs/release-notes/12/12-0-4/README.md b/docs/release-notes/12/12-0-4/README.md index bcf126b86086..37fa1dde930d 100644 --- a/docs/release-notes/12/12-0-4/README.md +++ b/docs/release-notes/12/12-0-4/README.md @@ -26,7 +26,7 @@ The vulnerability has been fixed in version 12.0.4. Versions prior to 12.0.0 are If you are unable to upgrade in a timely fashion, the following patch can be applied: [https://github.com/opf/openproject/pull/9983.patch](https://github.com/opf/openproject/pull/9983.patch) #### Credits -This security issue was responsibly disclosed by [Daniel Santos](https://github.com/bananabr) (Twitter [@bananabr](https://twitter.com/bananabr)). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our [statement on security](https://www.openproject.org/docs/development/security/). +This security issue was responsibly disclosed by [Daniel Santos](https://github.com/bananabr) (Twitter [@bananabr](https://twitter.com/bananabr)). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our [statement on security](https://www.openproject.org/docs/security-and-privacy/statement-on-security/). ### Bug fixes and changes - Fixed: Frontend including editor and time logging unusable when there are many activities \[[#40314](https://community.openproject.com/wp/40314)\] diff --git a/docs/release-notes/12/12-5-4/README.md b/docs/release-notes/12/12-5-4/README.md index f1a9178b1e69..d8c97050e46f 100644 --- a/docs/release-notes/12/12-5-4/README.md +++ b/docs/release-notes/12/12-5-4/README.md @@ -19,7 +19,7 @@ The release contains two security related bug fixes and we recommend updating to When a user registers and confirms their first two-factor authentication (2FA) device for an account, existing logged in sessions for that user account are not terminated. Likewise, if an administrators creates a mobile phone 2FA device on behalf of a user, their existing sessions are not terminated. The issue has been resolved in OpenProject version 12.5.4 by actively terminating sessions of user accounts having registered and confirmed a 2FA device. -This security related issue was responsibly disclosed by [Vaishnavi Pardeshi](mailto:researchervaishnavi0@gmail.com). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our [statement on security](https://www.openproject.org/docs/development/security/). +This security related issue was responsibly disclosed by [Vaishnavi Pardeshi](mailto:researchervaishnavi0@gmail.com). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our [statement on security](https://www.openproject.org/docs/security-and-privacy/statement-on-security/). For more information, [please see our security advisory](https://github.com/opf/openproject/security/advisories/GHSA-xfp9-qqfj-x28q). @@ -33,7 +33,7 @@ When a user requests a password reset, an email is sent with a link to confirm a The issue has been resolved in OpenProject version 12.5.4 by actively revoking any active password reset tokens for user accounts having changed their passwords successfully within the application. -This security related issue was responsibly disclosed by [Vaishnavi Pardeshi](mailto:researchervaishnavi0@gmail.com). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our [statement on security](https://www.openproject.org/docs/development/security/). +This security related issue was responsibly disclosed by [Vaishnavi Pardeshi](mailto:researchervaishnavi0@gmail.com). Thank you for reaching out to us and your help in identifying this issue. If you have a security vulnerability you would like to disclose, please see our [statement on security](https://www.openproject.org/docs/security-and-privacy/statement-on-security/). diff --git a/docs/release-notes/8/8-3-2/README.md b/docs/release-notes/8/8-3-2/README.md index 7c03a9a4521b..1794ee301e35 100644 --- a/docs/release-notes/8/8-3-2/README.md +++ b/docs/release-notes/8/8-3-2/README.md @@ -32,7 +32,7 @@ For the full advisory and patches for older unsupported versions, post](https://groups.google.com/d/msg/openproject-security/XlucAJMxmzM/hESpOaFVAwAJ). For our statement on security and further information on how to responsible disclose security related issues to us, please see our -[statement on security](../../../development/security/). +[statement on security](https://www.openproject.org/docs/security-and-privacy/statement-on-security/). Thanks to Thanaphon Soo from the [SEC Consult Vulnerability Lab](https://www.sec-consult.com) for identifying and responsibly diff --git a/docs/security-and-privacy/statement-on-security/README.md b/docs/security-and-privacy/statement-on-security/README.md index abd2ee6cc142..33d9f9467099 100644 --- a/docs/security-and-privacy/statement-on-security/README.md +++ b/docs/security-and-privacy/statement-on-security/README.md @@ -57,7 +57,7 @@ If you can, please send us a PGP-encrypted email using the following key: - Key ID: [0x7D669C6D47533958](https://keys.openpgp.org/vks/v1/by-fingerprint/BDCFE01EDE84EA199AE172CE7D669C6D47533958), - Fingerprint BDCF E01E DE84 EA19 9AE1 72CE 7D66 9C6D 4753 3958 -- You may also find the key [attached in our OpenProject repository.](https://github.com/opf/openproject/blob/dev/docs/development/security/security-at-openproject.com.asc) +- You may also find the key [attached in our OpenProject repository.](https://www.openproject.org/docs/security-and-privacy/statement-on-security/security-at-openproject.com.asc) Please include a description on how to reproduce the issue if possible. Our security team will get your email and will attempt to reproduce and fix the issue as soon as possible.