[Git][security-tracker-team/security-tracker][master] Bring documentation wrt severities in line with current practice
Moritz Muehlenhoff (@jmm)
jmm at debian.org
Tue Aug 25 10:49:02 BST 2026
Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker
Commits:
ee436d66 by Moritz Muehlenhoff at 2026-08-25T11:47:19+02:00
Bring documentation wrt severities in line with current practice
- - - - -
1 changed file:
- doc/security-team.d.o/security_tracker
Changes:
=====================================
doc/security-team.d.o/security_tracker
=====================================
@@ -377,7 +377,7 @@ triaging (e.g., bug severity) you can leave a TODO note for reviewing,
explaining which aspect has to be reviewed. For example:
CVE-2013-7295 (Tor before 0.2.4.20, when OpenSSL 1.x is used in ...)
- - tor 0.2.4.20-1 (low)
+ - tor 0.2.4.20-1
[wheezy] - tor <no-dsa> (Minor issue)
TODO: review, severity. The exploitation scenario is too complicated.
@@ -397,52 +397,32 @@ the Debian package:
Severity levels
---------------
-These levels are mostly used to prioritize the order in which security
-problems are resolved. Anyway, we have a rough overview on how you should
-assess these levels.
-
-**unimportant**: This problem does not affect the Debian binary package, e.g.,
- a vulnerable source file, which is not built, a vulnerable file
- in `doc/foo/examples/`, PHP Safe mode bugs, path disclosure (doesn't
- matter on Debian).
- All "non-issues in practice" fall also into this category, like
- issues only "exploitable" if the code in question is setuid root,
- exploits which only work if someone already has administrative
- privileges or similar.
- This severity is also used for vulnerabilities in packages which
- are not covered by security support.
-
-**low** : A security problem, which has only mild security implications
- (local DoS, `/tmp` file races and so on).
-
-**medium** : For anything which permits code execution after user interaction.
- Local privilege escalation vulnerabilities are in this category as
- well, or remote privilege escalation if it's constrained to the
- application (i.e., no shell access to the underlying system, such
- as simple cross-site scripting). Most remote DoS vulnerabilities
- fall into this category, too.
-
-**high** : A typical, exploitable security problem, which you'll really
- like to fix or at least implement a workaround. This could
- be because the vulnerable code is very broadly used, because
- an exploit is in the wild or because the attack vector is
- very wide.
- Should be put into that category anything that permits an attacker
- to execute arbitrary code on the vulnerable system (with or
- without root privileges) and high-impact denial-of-service bugs
- (for instance, an IPv4 forwarding path vulnerability which
- requires only very few packets to exploit).
- Significant defects in security software can be rated "high" as
- well (for instance, a vulnerability in a piece of cryptographic
- software which flags forged digital signatures as genuine).
-
-Certain packages may get higher or lower rating than usual, based on
-their importance.
+Debian doesn't use severity levels (Historic security tracker entries until approximately
+2019 still occasionally have annotations about low/medium/high), but they are no longer
+applied to current data.
Assessments of severity are made against the binaries as provided by Debian. For each
-vulnerability, the severity assigned within the Debian Security Tracker only relates to
-how Debian views that vulnerability and how quickly the fix may need to be applied to
-the specified package(s) within Debian.
+vulnerability, the triage applied only relates to how Debian views that vulnerability
+and how quickly the fix may need to be applied to the specified package(s) within Debian.
+
+This leaves two remaining classifications; security issues which apply to the
+packages provided by Debian and non-issues.
+
+- If a CVE entry is marked as **unimportant**, the problem does not affect the Debian
+binary package(s), e.g., a vulnerable source file, which is not built, a vulnerable file
+in `doc/foo/examples/`, path disclosure (doesn't matter on Debian).
+All "non-issues in practice" fall also into this category, like issues only "exploitable"
+if the code in question is setuid root (but not configured as such by Debian), exploits
+which only work if someone already has administrative, crashes without the potential for
+code execution in in CLI tools or similar. This also applies to bogus CVE assignments
+for bugs not considered actual security problems. In some cases these get rejected, but
+if not we simply annotate them as **unimportant** as well. It is also used for
+vulnerabilities in packages which are not covered by security support.
+
+- All other vulnerabilities are potentially candidates for being fixed. Anything Debian
+attends to address in an DSA update via security.debian.org gets added to ``data/dsa-needed.txt``.
+Lower impact vulnerabilities are marked as ``<no-dsa>``, see "Issues not warranting a
+security advisory" for details.
### Vulnerabilities without an assigned CVE id
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ee436d666e0fb8cf845de22b012efe539d13d116
--
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ee436d666e0fb8cf845de22b012efe539d13d116
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260825/75453bc4/attachment-0001.htm>
More information about the debian-security-tracker-commits
mailing list